Loading story…
Researchers detailed a previously unreported backdoor dubbed Filesnfer, highlighting malware samples in both Python and C# that were associated with suspected China-linked espionage activity and discussed alongside reporting that tied the tooling to the Buckeye/APT3 cluster. The reporting noted that attribution remained unconfirmed, with the link relying in part on collaboration with another undisclosed vendor, leaving the technical analysis more definitive than the actor assessment.
Analysis of the malware showed overlapping code and strings across variants, including a Py2Exe-compiled Python sample and a C# payload delivered through a PowerShell loader. Filesnfer was described as a backconnect tool that communicates over a configured host and port and supports file upload and download, directory listing, command execution, and process enumeration, indicating its use as a flexible post-compromise implant for remote control and data access on Windows systems.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A 1 May 2019 analysis compared multiple Filesnfer variants, including a Py2Exe-compiled Python sample and a C# payload delivered by a PowerShell loader. It described overlaps in code and strings used to pivot between samples and detailed capabilities such as file transfer, directory listing, command execution, process enumeration, and socket-based backconnect communications.
On 6 May 2019, Symantec published reporting on a series of tools possibly used by APT3 or a broader China-based espionage apparatus, including a previously publicly unreported backdoor dubbed Filesnfer. The reporting said the link between Filesnfer and APT3 came through collaboration with another vendor and that corroborating analysis was unavailable at the time.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple **China-linked espionage operations**, but they are not the same incident. One campaign tracked by Palo Alto Networks as **CL-STA-1087** targeted military organizations in Southeast Asia over several years, focusing on intelligence collection related to military capabilities, organizational structures, and cooperation with Western armed forces. The activity used custom malware including the **AppleChris** and **MemFun** backdoors and a **Getpass** credential harvester, alongside stable infrastructure and selective file collection consistent with long-term state-sponsored espionage. A separate report from Zscaler described a **China-nexus** intrusion set targeting entities in the Persian Gulf using conflict-themed lures to deliver **PlugX**. That attack chain relied on a ZIP archive containing a deceptive `.lnk` file, which downloaded a malicious CHM file, used `hh.exe` for extraction, displayed a decoy PDF about Iranian missile strikes, and ultimately installed a multi-stage PlugX payload. The other references are unrelated: one is a technical review of **CVE-2026-25185** in Windows shortcut handling, and another covers malicious Packagist themes shipping trojanized jQuery tied to **FUNNULL** infrastructure rather than the China-linked espionage activity described in the relevant reports.
Jun 29, 2026
Researchers disclosed **SockDetour**, a previously undocumented Windows backdoor used against U.S. defense contractors as a stealthy secondary implant for persistence. The malware operates **filelessly** and **socketlessly**, hijacking legitimate processes' network sockets with the Microsoft Detours library to create an encrypted command-and-control channel that is difficult to spot through host or network monitoring. Palo Alto Networks Unit 42 said at least four U.S.-based defense contractors were targeted and confirmed compromise at one organization, with compilation artifacts indicating the tool may have been in use since at least **July 2019**. Unit 42 linked the activity to the China-linked **TiltedTemple** cluster, also tracked by Microsoft as **DEV-0322**, and said the campaign overlapped with late-2021 intrusions involving **Zoho ManageEngine** exploitation; reporting also noted possible ties to **APT27** based on tactics and targeting. In one case, attackers delivered SockDetour from an external FTP server hosted on a compromised **QNAP NAS** device that had likely been exploited through **`CVE-2021-28799`**, the same flaw previously abused to deploy **eCh0raix** and associated with earlier **QLocker** ransomware activity, showing how vulnerable internet-facing NAS infrastructure was repurposed to support espionage operations.
Aug 15, 2026
Elastic Security Labs linked the **REF7707** cyberespionage activity to a modular malware ecosystem targeting a South American foreign ministry and likely victims in Southeast Asia. The operators used valid credentials and Windows administrative functionality to deploy the PATHLOADER and GUIDLOADER loaders, including a renamed `cdb.exe` Microsoft debugger to execute in-memory shellcode. PATHLOADER retrieved encrypted payloads from typosquatted and attacker-controlled infrastructure before launching **FINALDRAFT**, a Windows and Linux remote-access tool that used Microsoft Graph API access to communicate through Outlook draft messages. FINALDRAFT supports collection and exfiltration, process injection, proxying, file operations, network discovery, in-memory PowerShell with AMSI/ETW bypasses, and Pass-the-Hash activity; samples spanning 2023 and 2024 indicate sustained development. Elastic later identified **NANOREMOTE** and its WMLOADER delivery component as likely related to the same cluster: WMLOADER masquerades as security software, decrypts `wmsetup.log` with AES-CBC, and executes the backdoor in memory, while NANOREMOTE uses the Google Drive API for command-and-control, payload staging, and bidirectional file transfer. Shared loader behavior, cryptographic material, filenames, code, and network traits indicate a common development environment or codebase.
Sep 9, 2026