Trochilus

Trochilus is an open-source Windows remote access trojan implemented in C++ that has been publicly available since at least 2015 and has been repeatedly reused, modified, or adapted by multiple China-aligned espionage clusters. It functions as a backdoor for remote command execution and file transfer, and observed variants inject into legitimate Windows processes such as svchost.exe to operate in memory. Trochilus has also been delivered through DLL sideloading and multi-stage loader chains in which a legitimate executable loads a malicious DLL that decrypts or unpacks the final payload.

Trochilus is notable less as a single closed malware operation than as a reusable codebase that has served as the foundation for other malware families. RedLeaves was assessed to have been built by modifying Trochilus source code, and SprySOCKS was derived from Trochilus with substantial changes, including Linux implementations of Trochilus-like functionality and later Windows variants. Reporting has also tied customized Trochilus variants to Webworm and to activity associated with APT10 and APT31. In targeted intrusions, Trochilus-derived tooling has appeared against government, telecommunications, technology, defense, academia, media, managed service provider, aerospace, electric power, and other strategic sectors across Asia and elsewhere.

High-confidence capabilities directly associated with Trochilus include remote command execution, file download, and process injection. Delivery has been observed via DLL sideloading chains and embedded deployment within droppers, while the malware itself is a Windows-focused RAT whose source code has influenced later cross-platform backdoors.