Threats Tagged 'stowaway'

Melofee is a Linux implant malware that has evolved over three years to include a modular architecture with hot-loadable components for shell access, file management, and command execution. It incorporates a kernel rootkit based on the Reptile project to enhance stealth and supports multiple communication protocols with RC4 encryption. The malware infrastructure uses fake certificates impersonating legitimate entities and shows code similarities with Windows implants linked to Chinese state-sponsored groups. The modular design allows dynamic loading of up to eleven specialized modules via a common plugin interface.

Since late 2025, government and diplomatic entities in Southeast Asia have been targeted by sophisticated attacks involving GoSerpent, a Go-based RAT with proxy capabilities. The malware receives encrypted arguments and deploys additional tools for data collection and credential dumping. GoSerpent has been active since 2021, with newer variants using AES-CBC encryption and ChaCha20 for communications. The campaign involves multiple stages: initial deployment of GoSerpent and ThumbcacheService to collect sensitive files, credential dumping via Mimikatz and QuarksDumpLocalHash, followed by deployment of Stowaway RAT in May 2026 and TmcLoader/TmcPayload for stealthy data exfiltration through network shares. The integrated toolset demonstrates sophisticated operational planning, with attackers leveraging Alibaba Cloud and UCLOUD HK infrastructure while exhibiting possible connections to the TetrisPhantom threat actor.

A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core component, EggStremeAgent, is a full-featured backdoor enabling extensive system reconnaissance, lateral movement, and data theft via an injected keylogger. The attack begins with EggStremeFuel deploying EggStremeLoader to set up a persistent service, which then executes EggStremeReflectiveLoader to launch EggStremeAgent. The framework's fileless nature and use of legitimate Windows processes make it difficult to detect, posing a significant and persistent threat.

MediumCampaignPhilippinesUnited KingdomFrance+3#eggstremefuel#eggstremereflectiveloader#stowaway