REF3864

REF3864 is an intrusion set tracked by Elastic Security Labs that targets Chinese-speaking users with trojanized software installers masquerading as legitimate applications including Telegram and Opera GX. The activity spans Windows, Linux, and Android, with the best-documented infection chain on Windows relying on malicious MSI packages and DLL side-loading to launch a custom loader named SADBRIDGE and ultimately deploy a Golang-based reimplementation of the QUASAR remote access trojan known as GOSAR. The Windows tradecraft uses staged execution through abused legitimate binaries, privilege escalation via UAC bypass, persistence through Windows services, scheduled tasks, and registry modifications, and defense evasion through AMSI and ETW patching, long sleep delays, and anti-analysis checks. SADBRIDGE has also been observed using multiple process-injection methods including PoolParty, APC queue abuse, and token manipulation, then injecting the final payload into common Windows processes. Configuration artifacts indicate the operation has likely been active since at least December 2023. GOSAR is a multi-functional remote access trojan for Windows and Linux that preserves compatibility with the original QUASAR protocol while extending functionality. Reported capabilities include system information collection, command execution, screenshot capture, keylogging, clipboard theft, plugin execution, hidden VNC, and broader remote administration features. The malware appears to be under active development, with evolving functionality and incomplete listener behavior observed in some samples. Available evidence indicates both operators and intended victims are likely Chinese-speaking. This assessment is supported by Chinese-language logging, checks for Chinese security products, and Chinese-language firewall-rule naming. Public reporting did not attribute REF3864 to a specific named threat actor or state sponsor and did not establish a definitive dominant motivation.