kingsoft

A previously unknown malware framework called BambooToken, active since at least 2023, is now using the Message Queuing Telemetry Transport (MQTT) protocol to communicate with Windows and Linux systems. [...]

The threat actor known as Dragon Breath has been observed making use of a multi-stage loader codenamed RONINGLOADER to deliver a modified variant of a remote access trojan called Gh0st RAT. The campaign, which is primarily aimed at Chinese-speaking users, employs trojanized NSIS installers masquerading as legitimate software like Google Chrome and Microsoft Teams, according to Elastic Security Labs. "The infection chain employs a multi-stage delivery mechanism that leverages various evasion techniques, with many redundancies aimed at neutralising endpoint security products popular in the Chinese market," security researchers Jia Yu Chan and Salim Bitam said. "These include bringing a legitimately signed driver, deploying custom WDAC policies, and tampering with the Microsoft Defender binary through PPL [Protected Process Light] abuse." Dragon Breath, also known as APT-Q-27 and Golden Eye, was previously highlighted by Sophos in May 2023 in connection with a campaign that leveraged a technique called double-dip DLL side-loading in attacks targeting users in the Philippines, Japan, Taiwan, Singapore, Hong Kong, and China. The hacking group, assessed to be active since at least 2020, is linked to a larger Chinese-speaking entity tracked as Miuuti Group that's known for attacking the online gaming and gambling industries. In the latest campaign documented by Elastic Security Labs, the malicious NSIS installers for trusted applications act as a launchpad for two more embedded NSIS installers, one of which ("letsvpnlatest.exe") is benign and installs the legitimate software. The second NSIS binary ("Snieoatwtregoable.exe") is responsible for stealthily triggering the attack chain. This involves delivering a DLL and an encrypted file ("tp.png"), with the former used to read the contents of the supposed PNG image and extract shellcode designed to launch another binary in memory. RONINGLOADER, besides attempting to remove any userland hooks by loading a fresh new "ntdll.dll," tries to elevate its privileges by using the runas command and scans a list of running processes for hard-coded antivirus-related solutions, such as Microsoft Defender Antivirus, Kingsoft Internet Security, Tencent PC Manager, and Qihoo 360 Total Security. The malware then proceeds to terminate those identified processes. In the event the identified process is associated with Qihoo 360 Total Security (e.g., "360tray.exe," "360Safe.exe," or "ZhuDongFangYu.exe"), it takes a different approach. This step involves the following sequence of actions - Block all network communication by changing the firewall Inject shellcode into the process (vssvc.exe) associated with the Volume Shadow Copy (VSS) service, but not before granting itself the SeDebugPrivilege token Start the VSS service and get its process ID Inject shellcode into the VSS service process using the technique called PoolParty Load and make use of a signed driver named "ollama.sys" to terminate the three processes by means of a temporary service called "xererre1" Restore the firewall settings For other security processes, the loader directly writes the driver to disk and creates a temporary service called "ollama" to load the driver, perform process termination, and stop and delete the service. Once all security processes have been killed on the infected host, RONINGLOADER runs batch scripts to bypass User Account Control (UAC) and create firewall rules to block inbound and outbound connections associated with Qihoo 360 security software. The malware has also been observed using two techniques documented earlier this year by security researcher Zero Salarium that abuse PPL and the Windows Error Reporting ("WerFaultSecure.exe") system (aka EDR-Freeze) to disable Microsoft Defender Antivirus. Furthermore, it targets Windows Defender Application Control (WDAC) by writing a malicious policy that explicitly blocks Chinese security vendors Qihoo 360 Total Security and Huorong Security. The end goal of the loader is to inject a rogue DLL into "regsvr32.exe," a legitimate Windows binary, to conceal its activity and launch a next-stage payload into another legitimate, high-privilege system process like "TrustedInstaller.exe" or "elevation_service.exe." The final malware deployed is a modified version of Gh0st RAT. The trojan is designed to communicate with a remote server to fetch additional instructions that allow it to configure Windows Registry keys, clear Windows Event logs, download and execute files from provided URLs, alter clipboard data, run commands via "cmd.exe," inject shellcode into "svchost.exe," and execute payloads dropped to disk. The variant also implements a module that captures keystrokes, clipboard contents, and foreground window titles. Brand Impersonation Campaigns Target Chinese Speakers with Gh0st RAT The disclosure comes as Palo Alto Networks Unit 42 said it identified two interconnected malware campaigns that have employed "large-scale brand impersonation" to deliver Gh0st RAT to Chinese-speaking users. The activity has not been attributed to any known threat actor or group. While the first campaign – named Campaign Trio – took place between February and March 2025 by mimicking i4tools, Youdao, and DeepSeek across over 2,000 domains, the second campaign, detected in May 2025, is said to have been more sophisticated, impersonating more than 40 applications, including QQ Music and Sogou browser. The second wave has been codenamed Campaign Chorus. "From the first campaign to the second, the adversary advanced from simple droppers to complex, multi-stage infection chains that misuse legitimate, signed software to bypass modern defenses," security researchers Keerthiraj Nagaraj, Vishwa Thothathri, Nabeel Mohamed, and Reethika Ramesh said. The domains have been found to host ZIP archives containing the trojanized installers, ultimately paving the way for the deployment of Gh0st RAT. The second campaign, however, not only leverages more software programs as lures to reach a wider demographic of Chinese speakers, but also employs an "intricate and elusive" infection chain using intermediary redirection domains to fetch the ZIP archives from public cloud service buckets. In doing so, the approach can bypass network filters that are capable of blocking traffic from unknown domains, not to mention the threat actor's operational resilience. The MSI installer, in this case, also runs an embedded Visual Basic Script that's responsible for decrypting and launching the final payload by means of DLL side-loading. "The parallel operation of both old and new infrastructure through sustained activity suggests an operation that is not merely evolving but consists of multiple infrastructures and distinct tool sets simultaneously," the researchers said. "This could indicate A/B testing of TTPs, targeting different victim sets with different levels of complexity, or simply a cost-effective strategy of continuing to leverage older assets as long as they remain effective."

The threat actors behind a malware family known as Winos 4.0 (aka ValleyRAT) have expanded their targeting footprint from China and Taiwan to target Japan and Malaysia with another remote access trojan (RAT) tracked as HoldingHands RAT (aka Gh0stBins). "The campaign relied on phishing emails with PDFs that contained embedded malicious links," Pei Han Liao, researcher with Fortinet's FortiGuard Labs, said in a report shared with The Hacker News. "These files masqueraded as official documents from the Ministry of Finance and included numerous links in addition to the one that delivered Winos 4.0." Winos 4.0 is a malware family that's often spread via phishing and search engine optimization (SEO) poisoning, directing unsuspecting users to fake websites masquerading as popular software like Google Chrome, Telegram, Youdao, Sogou AI, WPS Office, and DeepSeek, among others. The use of Winos 4.0 is primarily linked to an "aggressive" Chinese cybercrime group known as Silver Fox, which is also tracked as SwimSnake, The Great Thief of Valley (or Valley Thief), UTG-Q-1000, and Void Arachne. Last month, Check Point attributed the threat actor to the abuse of a previously unknown vulnerable driver associated with WatchDog Anti-malware as part of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling security software installed on compromised hosts. Then weeks later, Fortinet shed light on another campaign that took place in August 2025, leveraging SEO poisoning to distribute HiddenGh0st and modules associated with the Winos malware. Silver Fox's targeting of Taiwan and Japan with HoldingHands RAT was also documented by the cybersecurity company and a security researcher named somedieyoungZZ back in June, with the attackers employing phishing emails containing booby-trapped PDF documents to activate a multi-stage infection that ultimately deploys the trojan. It's worth noting at this stage that both Winos 4.0 and HoldingHands RAT are inspired by another RAT malware referred to as Gh0st RAT, which had its source code leaked in 2008 and has since been widely adopted by various Chinese hacking groups. Fortinet said it identified PDF documents posing as a tax regulation draft for Taiwan that included a URL to a Japanese language web page ("twsww[.]xin/download[.]html"), from where victims are prompted to download a ZIP archive responsible for delivering HoldingHands RAT. Further investigation has uncovered attacks targeting China that have utilized taxation-themed Microsoft Excel documents as lures, some dating back to March 2024, to distribute Winos. Recent phishing campaigns, however, have shifted their focus to Malaysia, using fake landing pages to deceive recipients into downloading HoldingHands RAT. The starting point is an executable claiming to be an excise audit document. It's used to sideload a malicious DLL, which functions as a shellcode loader for "sw.dat," a payload that's designed to run anti-virtual machine (VM) checks, enumerate active processes against a list of security products from Avast, Norton, and Kaspersky, and terminate them if found, escalate privileges, and terminate the Task Scheduler. It also drops several other files in the system's C:\Windows\System32 folder - svchost.ini, which contains the Relative Virtual Address (RVA) of VirtualAlloc function TimeBrokerClient.dll, the legitimate TimeBrokerClient.dll renamed as BrokerClientCallback.dll. msvchost.dat, which contains the encrypted shellcode system.dat, which contains the encrypted payload wkscli.dll, an unused DLL "The Task Scheduler is a Windows service hosted by svchost.exe that allows users to control when specific operations or processes are run," Fortinet said. "The Task Scheduler’s recovery setting is configured to restart the service one minute after it fails by default." "When the Task Scheduler is restarted, svchost.exe is executed and loads the malicious TimeBrokerClient.dll. This trigger mechanism does not require the direct launch of any process, making behavior-based detection more challenging." For privilege escalation, "sw.dat" impersonates the TrustedInstaller account to execute code. TrustedInstaller is a high-level Windows system account that's designed to protect core system files, such as those present in the C: drive, from being modified, even by administrators. It's part of a broader security feature called Windows Resource Protection (WRP) that's designed to prevent accidental changes to files, folders, and registry keys installed as part of the operating system. "To achieve this, the malware first enables the SeDebugPrivilege privilege to gain access to the Winlogon process and its security token," Fortinet threat security researcher Rachael Pei told The Hacker News. "With that access it obtains and adopts the Winlogon token to run as the Winlogon account (SYSTEM)." "From that elevated context the malware then proceeds to acquire a TrustedInstaller security context. TrustedInstaller is a built-in Windows system account. Certain files, registry keys, etc, can only be accessed with the account. An example is C:\Windows\System32\TimeBrokerClient.dll for the Task Scheduler-based execution. The malware needs to rename the legitimate TimeBrokerClient.dll as BrokerClientCallback.dll and this needs TrustedInstaller permission." The primary function of "TimeBrokerClient.dll" is to allocate memory for the encrypted shellcode within "msvchost.dat" by invoking the VirtualAlloc() function using the RVA value specified in "svchost.ini." In the next stage, "msvchost.dat" decrypts the payload stored in "system.dat" to retrieve the HoldingHands payload. HoldingHands is equipped to connect to a remote server, send host information to it, send a heartbeat signal every 60 seconds to maintain the connection, and receive and process attacker-issued commands on the infected system. These commands allow the malware to capture sensitive information, run arbitrary commands, and download additional payloads. A new feature addition is a command that makes it possible to update the command-and-control (C2) address used for communications via a Windows Registry entry. Pei also pointed out that Chinese speakers appear to be a primary focus of the latest campaign, adding "the most likely motivation appears to be regional intelligence collection, with the malware lying dormant as it awaits further commands." Operation Silk Lure Targets China with ValleyRAT The development comes as Seqrite Labs detailed an ongoing email-based phishing campaign that has leveraged C2 infrastructure hosted in the U.S., targeting Chinese companies in the fintech, cryptocurrency, and trading platform sectors to ultimately deliver Winos 4.0. The campaign has been codenamed Operation Silk Lure, owing to its China-related footprint. "The adversaries craft highly targeted emails impersonating job seekers and send them to HR departments and technical hiring teams within Chinese firms," researchers Dixit Panchal, Soumen Burma, and Kartik Jivani said. "These emails often contain malicious .LNK (Windows shortcut) files embedded within seemingly legitimate résumés or portfolio documents. When executed, these .LNK files act as droppers, initiating the execution of payloads that facilitate initial compromise." The LNK file, when launched, runs PowerShell code to download a decoy PDF resume, while stealthily dropping three additional payloads to the "C:\Users\ \AppData\Roaming\Security" location and executing it. The PDF resumes are localized and tailored for Chinese targets so as to increase the likelihood of success of the social engineering attack. The payloads dropped are as follows - CreateHiddenTask.vbs, which creates a scheduled task to launch "keytool.exe" every day at 8:00 a.m. keytool.exe, which uses DLL side-loading to load jli.dll jli.dll, a malicious DLL that launches the Winos 4.0 malware encrypted and embedded within keytool.exe "The deployed malware establishes persistence within the compromised system and initiates various reconnaissance operations," the researchers said. "These include capturing screenshots, harvesting clipboard contents, and exfiltrating critical system metadata." The trojan also comes with various techniques to evade detection, including attempting to uninstall detected antivirus products and terminating network connections associated with security programs such as Kingsoft Antivirus, Huorong, or 360 Total Security to interfere with their regular functions. "This exfiltrated information significantly elevates the risk of advanced cyber espionage, identity theft, and credential compromise, thereby posing a serious threat to both organizational infrastructure and individual privacy," the researchers added. (The story was updated after publication with additional insights from Fortinet FortiGuard Labs.)

Chinese-speaking users are the target of a search engine optimization (SEO) poisoning campaign that uses fake software sites to distribute malware. "The attackers manipulated search rankings with SEO plugins and registered lookalike domains that closely mimicked legitimate software sites," Fortinet FortiGuard Labs researcher Pei Han Liao said. "By using convincing language and small character substitutions, they tricked victims into visiting spoofed pages and downloading malware." The activity, which was discovered by the cybersecurity company in August 2025, leads to the deployment of malware families like HiddenGh0st and Winos (aka ValleyRAT), both of which are variants of a remote access trojan called Gh0st RAT. It's worth noting that the use of Winos has been attributed to a cybercrime group known as Silver Fox, which is also tracked as SwimSnake, The Great Thief of Valley (or Valley Thief), UTG-Q-1000, and Void Arachne. It's believed to be active at least since 2022. In the latest attack chain documented by Fortinet, users searching for tools like DeepL Translate, Google Chrome, Signal, Telegram, WhatsApp, and WPS Office on Google are redirected to bogus sites to trigger the delivery of the malware using trojanized installers. "A script named nice.js controls the malware delivery process on these sites," Fortinet explained. "The script follows a multi-step chain: it first calls a download link that returns JSON data, which includes a secondary link. That secondary link then points to another JSON response containing a link that redirects to the final URL of the malicious installer." Present within the installer is a malicious DLL ("EnumW.dll") that carries out several anti-analysis checks to sidestep detection, including extracting another DLL ("vstdlib.dll") to overwhelm analysis tools by inflating memory usage and slowing their performance. The second DLL is also engineered to unpack and launch the main payload, but not before ascertaining the presence of 360 Total Security antivirus software on the compromised host. If present, the malware uses a technique called TypeLib COM hijacking to set up persistence and ultimately launch a Windows executable ("insalivation.exe") In the event the antivirus software is not installed on the host, persistence is achieved by creating a Windows shortcut that points to the same executable. The end goal of the infection is to sideload a DLL ("AIDE.dll") that initiates three core functions - Command-and-Control (C2), to establish communication with a remote server and exchange data in an encrypted format Heartbeat, to collect system and victim data and enumerate running processes against a hard-coded list of security products Monitor, to evaluate the victim's environment to confirm persistence, track user activity, and beacon to the C2 server The C2 module also supports commands to download additional plugins, log keystrokes and clipboard data, and even hijack cryptocurrency wallets associated with Ethereum and Tether. Some of the identified plugins are capable of keeping tabs on the victim's screen and have been previously identified as part of the Winos framework. "The installers contained both the legitimate application and the malicious payload, making it difficult for users to notice the infection," Fortinet said. "Even highly ranked search results were weaponized in this way, underscoring the importance of carefully inspecting domain names before downloading software." Chinese Speakers Targeted by Malware Trifecta, Including New kkRAT The development comes as Zscaler ThreatLabz flagged a separate campaign, also targeting Chinese-speaking users, with a previously undocumented malware called kkRAT since early May 2025, along with Winos and FatalRAT. kkRAT "shares code similarities with both Gh0st RAT and Big Bad Wolf (大灰狼), a RAT typically leveraged by China-based cybercriminals," Zscaler researcher Muhammed Irfan V A said. "kkRAT employs a network communication protocol similar to Ghost RAT, with an added encryption layer after data compression. The RAT's features include clipboard manipulation to replace cryptocurrency addresses and the deployment of remote monitoring tools (i.e. Sunlogin, GotoHTTP)." Like the aforementioned activity, the attack campaign uses fake installer pages mimicking popular software like DingTalk to deliver the three trojans. The phishing sites are hosted on GitHub pages, allowing the bad actors to abuse the trust associated with a legitimate platform for malware distribution. The GitHub account used to deploy the pages is no longer available. Once launched by the victim, the installer hosted on the sites runs a series of checks to identify sandbox environments and virtual machines (VMs), as well as bypass security software. It also requests for administrator privileges, which, if granted, enables it to enumerate and temporarily disable all active network adapters, effectively interfering with the regular functioning of antivirus programs. Another notable aspect of the malware is its use of the Bring Your Own Vulnerable Driver (BYOVD) technique to disarm antivirus software installed on the host by reusing code from the RealBlindingEDR open-source project. The malware specifically searches for the following five programs - 360 Internet Security suite 360 Total Security HeroBravo System Diagnostics suite Kingsoft Internet Security QQ电脑管家 Once the relevant antivirus-related processes have been terminated, the malware takes steps to create a scheduled task that's run with SYSTEM privileges to execute a batch script to ensure that they are automatically killed every time after a user logs in to the machine. Furthermore, it modifies Windows Registry entries for 360 Total Security with the likely goal of disabling network checks. After all these actions are carried out, the malware proceeds to re-enable network adapters to restore the system's network connectivity. The primary responsibility of the installer is to launch shellcode, which, in turn, launches another obfuscated shellcode file named "2025.bin" from a hard-coded URL. This newly retrieved shellcode serves as a downloader for an artifact ("output.log") that subsequently reaches out to two different URLs to fetch two ZIP archives - trx38.zip, containing a legitimate executable file and a malicious DLL that's launched using DLL side-loading p.zip, containing a file named longlq.cl, which holds the encrypted final payload "The malware then will create a shortcut for the legitimate executable extracted from trx38.zip, add this shortcut to the startup folder for persistence, and execute the legitimate executable to sideload the malicious DLL," Zscaler said. "The malicious DLL decrypts and executes the final payload from the file longlq.cl. The final payload of the campaign varies based on the second ZIP archive that is downloaded." One of the three payloads is kkRAT. After establishing a socket connection with the C2 server, the malware profiles the victim machine and obtains various plugins to perform a wide range of data gathering tasks - Screen capturing and simulating user inputs such as keyboard and mouse actions Retrieving and modifying clipboard data Enabling remote desktop features, such as launching web browsers and terminating active processes Facilitating remote command execution via a shell interface Enabling Windows management on the screen Proving process management features, such as listing active processes and terminating them as and when required Generating a list of active network connections Providing application management features, such as listing installed software and uninstalling specific ones Enumerating and retrieving the list of values stored in the autorun Registry key Acting as a proxy to route data between a client and server using the SOCKS5 protocol In addition to these plugins, kkRAT offers support for a long list of commands to invoke the plugins; function as a clipper by replacing cryptocurrency wallet addresses copied to the clipboard; set up persistence; deploy GotoHTTP and Sunlogin; and clear data associated with 360 Speed Browser, Google Chrome, Internet Explorer, Mozilla Firefox, QQ Browser, Sogou Explorer, Skye, Telegram. "kkRAT's commands and plugins enable features such as clipboard hijacking to replace cryptocurrency wallet addresses, installing RMM tools like Sunlogin and GotoHTTP, and relaying network traffic that can be used to bypass firewalls and VPNs," Zscaler said.