CoughingDown

CoughingDown is a China-linked cyber-espionage threat actor associated with intrusions against government and related organizations and linked by multiple researchers to malware and tooling including the CoughingDown Core Module, WebDav-O, and activity overlapping with the EAGERBEE malware ecosystem. The group has been connected to operations in Russia and Belarus, and possible links have also been explored in campaigns affecting Japan and other parts of Asia through shared tooling and infrastructure. Observed tradecraft includes exploitation of public-facing applications for initial access, use of malicious Windows services for execution and persistence, DLL side-loading and DLL hijacking, code injection into legitimate service processes, credential dumping, reconnaissance, lateral movement via SMB and WMI, COM hijacking, event log clearing, and data exfiltration through attacker-controlled channels and cloud services. In one documented intrusion linked to CoughingDown, attackers exploited an IIS server vulnerability, created a malicious Windows service to load a DLL through svchost, performed internal discovery and credential theft, and used remote execution and exfiltration mechanisms consistent with post-compromise espionage activity. CoughingDown has also been assessed with medium confidence to be related to EAGERBEE activity based on code overlap, shared command structures, and overlapping infrastructure. EAGERBEE is a modular backdoor and downloader framework with a plugin orchestrator and plugins for file management, process execution, service control, network enumeration, shell access, reflective loading, and RDP enablement. Related intrusions have used legitimate Windows services such as MSDTC, IKEEXT, and SessionEnv to load malicious DLLs, and have included exploitation of Microsoft Exchange via CVE-2021-26855 followed by web shell deployment. Because EAGERBEE appears to be used by multiple China-based groups, attribution of all EAGERBEE operations to CoughingDown is not warranted; however, the relationship between CoughingDown and at least part of this tooling cluster is supported by reported code and infrastructure overlap. Overall, CoughingDown is best characterized as a China-linked espionage actor that relies on modular malware, service-based persistence, stealthy in-memory execution, and conventional post-exploitation techniques to maintain access, move laterally, collect information, and exfiltrate data from targeted networks.