Loading malware…
Motnug is a malware loader associated with Chinese espionage activity, most notably operations attributed to SparklingGoblin and reporting that also observed its use in activity linked to Red Kelpie (APT41). It is used as a staging component to deploy follow-on payloads rather than serving as the primary long-term implant. Documented intrusions place it alongside toolchains that include SideWalk, CROSSWALK, Korplug (PlugX), and Cobalt Strike, indicating a role in multi-stage post-compromise operations.
Observed use of Motnug has been tied to espionage campaigns targeting organizations in Asia, including academic and telecommunications-related environments, and it has also appeared in activity involving broader compromises of internet-facing infrastructure. In one reported case, a Motnug variant was deployed during an intrusion set associated with FamousSparrow, although that overlap was treated as an operational link rather than proof that the clusters are identical.
High-confidence public reporting supports classifying Motnug as a loader used to execute or deliver additional malware after access has been obtained. Specific initial infection vectors for Motnug itself are not established with high confidence in the available information.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
It makes use of Motnug and ChaCha20-based loaders, the CROSSWALK and SideWalk backdoors, along with Korplug (aka PlugX) and Cobalt Strike.
"...attackers deployed a variant of Motnug that is a loader used by SparklingGoblin."
1 distinct technique documented for this family, organized by ATT&CK tactic.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A loader used by SparklingGoblin in operations including prior targeting of the Hong Kong university.
Loader malware; a variant was observed deployed in an incident connected to FamousSparrow, and it is noted as a loader used by the SparklingGoblin group.
Motnug is a loader malware used by Red Kelpie (APT41) to deploy additional payloads in targeted environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.