Loading story…
Researchers detailed ELMER, a Delphi-based backdoor attributed to the China-linked threat group APT16, describing its use against organizations in Japan and Taiwan across the high-tech, government, media, and financial sectors. The malware gathers host information including hostname and IP address, checks local proxy settings, dynamically resolves APIs, and uses custom string decryption and encryption routines to hinder analysis. Reporting tied the activity to APT16, a group previously tracked in broader threat intelligence coverage of advanced persistent threat operations.
ELMER communicates with command-and-control infrastructure over HTTP on port 443, beginning with an initial GET request and then sending victim data through POST requests formatted as HTML and obfuscated with a NOT-based encoding scheme. Analysts said the backdoor supports eight command types, enabling file upload and download, process execution, file and directory enumeration, file-content theft, process listing, and directory reporting. Published indicators included C2 IP 121.127.249.74, multiple URL paths, a legacy Internet Explorer user-agent string, and malware samples such as hash BED00A7B59EF2BD703098DA6D523A498C8FDA05DCE931F028E8F16FF434DC89E.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
FireEye published or updated its 'Advanced Persistent Threat Groups (APT Groups)' reference page, which is cited here as a source related to APT16 attribution context.
FireEye published a threat research post titled 'The EPS Awakens - Part 2,' which is one of the cited references connected to APT16 activity and tooling.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
Researchers linked the Chinese-aligned espionage group **Ke3chang**/**APT15** to a sustained campaign against diplomatic organizations, tying together older **RoyalDNS** and **RoyalCLI** activity with newer **Ketrican** malware and a previously undocumented backdoor named **Okrum**. ESET reported that Okrum was first detected in late 2016 and used against diplomatic missions in Slovakia, Belgium, Chile, Guatemala, and Brazil, extending a broader pattern of targeting government and foreign affairs entities in Europe and Latin America that earlier reporting had associated with Operation Ke3chang. The malware set shows an actor that has refreshed its tooling while preserving tradecraft across multiple years. Okrum provides basic backdoor access and depends heavily on manually executed shell commands and external utilities, while related tools used evasion techniques including payloads hidden in PNG files, anti-sandbox checks, and frequently changed loaders. Combined reporting from ESET, NCC Group, FireEye, and Intezer indicates APT15 remained active from at least 2015 through 2019, resurfacing with updated implants derived from older ones as it continued cyberespionage operations against diplomatic targets.
Aug 15, 2026
Researchers reported continued development of the **EAGERBEE** backdoor, also tracked as **Thumtais**, in espionage campaigns attributed to China-linked operators targeting government and private-sector organizations in Japan, Southeast Asia, Mongolia, and the Middle East. Recent investigations tied the malware to intrusion activity associated with **REF5961** and overlaps with **TA428/LuckyMouse**, while also noting possible links to **Tonto Team**. Earlier incidents included compromise of a foreign affairs ministry in an ASEAN state and a Japanese consulting company, where EAGERBEE appeared alongside other implants such as **RUDEBIRD** and **DOWNTOWN** and was delivered through DLL hijacking or sideloading chains. Newer EAGERBEE variants add capabilities aimed at persistence, stealth, and flexible command-and-control, including **listen-mode** operation that opens ports on infected hosts for inbound C2, encrypted configuration and communications, authenticated proxy support, and in-memory execution of downloaded payloads. Researchers also observed deployment of **WinDivert** to interfere with DNS lookups for security vendor domains and identified related tooling such as **OAED Loader** delivering the Go-based **NKN-goRAT**, which uses the decentralized **NKN** network for C2; defenders were advised to watch for unusual Windows services, newly opened TCP/UDP ports, dropped files, and traffic to `seed.nkn.org` over TCP/30003.
Aug 15, 2026