Loading malware…
MOONSHINE is an Android spyware family and associated exploit-and-malware framework used in targeted surveillance operations against Tibetan, Uyghur, Taiwanese, and related civil society communities. It has been reported since 2019 and is commonly delivered through trojanized mobile applications that masquerade as legitimate or community-relevant software, including messaging, religious, language, and utility apps. Distribution has also involved links shared through messaging and social platforms such as WhatsApp and Telegram, with lures tailored to the interests and languages of intended victims.
MOONSHINE supports covert collection of sensitive device data and user activity. Reported capabilities include access to microphones, cameras, messages, photos, files, call logs, contacts, and location data, including real-time tracking. Management-panel analysis has also shown support for file exfiltration, live audio capture, and screen recording, with differing access levels depending on permissions granted on the infected device. Earlier reporting on the exploit framework described a modular Android implant referred to by its developers as Scotch, with plugins enabling surveillance functions such as SMS and contact theft, GPS collection, screenshots, audio recording, camera capture, and shell command execution.
Separate reporting has described a MOONSHINE exploit kit used to compromise Android applications and embedded browsers by exploiting known vulnerabilities in Chromium-derived components and Tencent Browser Server. In observed campaigns, successful exploitation led to installation of additional malware, including the DarkNimbus backdoor. Although infrastructure and code overlap have been observed between MOONSHINE-related panels and exploit-kit infrastructure, MOONSHINE and DarkNimbus are treated as distinct malware families.
The malware shows signs of sustained development over multiple years, including evolving management interfaces and operational tooling. Open-source reporting has linked MOONSHINE activity to clusters tracked as POISON CARP and Earth Minotaur, and broader government and industry assessments have concluded that the surveillance objectives align with Chinese state interests. Targeting has focused heavily on individuals and organizations associated with issues the Chinese state considers politically sensitive, and the data collected by MOONSHINE is well suited to surveillance, monitoring, and harassment operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Exploit #8: Appears to be CVE-2019-5825 ... The specific exploit used here was written and published by Exodus Intelligence after they examined the git log for Chrome’s JavaScript engine, and found a vulnerability that had been fixed in source code, but whose patch had not yet shipped to Chrome users. | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Case study one: MOONSHINE. MOONSHINE is an Android spyware reported in 2019 by Citizen Lab as targeting Tibetan groups. MOONSHINE masquerades as a legitimate app to lure victims into installing it.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
Trend Micro researchers investigated a group named Earth Minotaur that used the MOONSHINE exploit kit in the wild. MOONSHINE exploit kit targets vulnerabilities in instant messaging apps on Android devices, primarily affecting Tibetan and Uyghur communities.
...including RoyalCLI and RoyalDNS, Okrum, Ketrum, and Android spyware named SilkBean and Moonshine.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Malicious scripts are hidden in otherwise legitimate apps and uploaded to app stores
The actors try to make their spyware appear more legitimate by uploading it to official app stores such as the Google Play Store and the Apple App Store or by adding malicious code to previously benign apps.
MOONSHINE masquerades as a legitimate app to lure victims into installing it. It has been shared via Telegram channels and links sent via WhatsApp.
The trojanised apps may request unnecessary permissions including local files.
The management interface reveals extensive surveillance capabilities, including the ability to exfiltrate files from devices as well as capture live audio and screen recordings.
85 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploit kit used to deliver the DarkNimbus backdoor in long-term surveillance operations.
Malware referenced as targeting mobile users via fake apps; details not provided in the excerpt.
Exploit kit/tooling linked to the Earth Minotaur threat cluster in the reporting.
Exploit kit tracked by Talos since 2023 and associated in this reporting with delivery of mobile exploits alongside the DarkNimbus backdoor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.