Loading malware…
UPPERCUT, also known as ANEL, is a Windows remote access trojan and backdoor associated with the China-linked cyberespionage group APT10, also called menuPass, and with MirrorFace, also tracked as Earth Kasha. Identified in 2017, it has been deployed against Japanese organizations, including academic, media, research, and government entities. Later operations extended its use to Taiwan and a Central European diplomatic institute.
UPPERCUT collects host information, including the logged-on username, proxy configuration, current timestamp, and time zone. It captures desktop screenshots in PNG format and transmits them to command-and-control infrastructure. It can download additional malicious tools and bypass Windows User Account Control. Early versions used process injection to activate an embedded backdoor. Its communications use Blowfish encryption, with some versions incorporating XOR and Base64 encoding; later versions use distinct hardcoded encryption keys for individual command-and-control destinations. Versions 5.3.0 and later employ opaque predicates and control-flow flattening to hinder analysis.
Delivery commonly involves spearphishing with malicious Office documents, including password-protected Word documents containing VBA macros. Historical delivery chains exploited CVE-2017-8759 and CVE-2017-11882 or abused legitimate Office features. Operators have used certutil to decode staged payloads and legitimate applications to execute UPPERCUT through DLL side-loading. In newer MirrorFace operations, the ANELLDR loader decrypts and loads the backdoor into memory. MirrorFace resumed using ANEL in 2024 after an apparent hiatus since approximately 2018–2019, including in an Expo 2025-themed spearphishing operation against a European diplomatic organization.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
When we tracked ChessMaster back in November, we noted that it exploited the SOAP WSDL parser vulnerability CVE-2017-8759 (patched in September 2017) within the Microsoft .NET framework to download additional malware. | this new campaign used a new backdoor (Detected by Trend Micro as BKDR_ANEL.ZKEI) that leverages the CVE-2017-8759 vulnerability for its cyberespionage activities.
While ChessMaster still uses the previous exploit, it also added more methods to its arsenal: one exploits another vulnerability, CVE-2017-11882 (patched in November 2017), which was also exploited to deliver illegal versions of the Loki infostealer. | this new campaign used a new backdoor (Detected by Trend Micro as BKDR_ANEL.ZKEI) that leverages the CVE-2017-8759 vulnerability for its cyberespionage activities.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In late-2018, the group updated their attack techniques, like the spear phishing emails, were now carrying malicious Word documents that attempted to deliver the UPPERCUT backdoor.
this new campaign used a new backdoor (Detected by Trend Micro as BKDR_ANEL.ZKEI) that leverages the CVE-2017-8759 vulnerability for its cyberespionage activities.
Alongside the new target, the group revived ANEL (also called UPPERCUT), an APT10 backdoor that had been dormant since roughly 2018-2019, moving away from LODEINFO, its previous mainstay implant.
Alongside the new target, the group revived ANEL (also called UPPERCUT), an APT10 backdoor that had been dormant since roughly 2018-2019, moving away from LODEINFO, its previous mainstay implant.
Third party reporting also suggests that the group has adopted tools including the ANEL backdoor and Cobalt Strike.
21 distinct techniques documented for this family, organized by ATT&CK tactic.
例えば、次のようなファイルの作成、プロセスの実行、DLLのロード、通信をしている場合にマルウェアとして検知することができるルールを記述することができます。
At that time, ChessMaster was using ANEL as a backdoor into the target system then injects code into svchost.exe, which then decrypts and activates the embedded backdoor.
The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.
ANEL version 5.3.0 or later are obfuscated with opaque predicates control flow flattening
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.
The content repeatedly describes malware and threat actors collecting the current date, time, or time zone from victim systems, including examples such as "The net time command can be used... to determine the local or remote system time" and commands like "net time \\hostname" and "w32tm /tz".
rules: - ruletype: "ipv4" target: "ipv4" rule: "45.32.116.146"
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
48 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
48 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
APT10-linked backdoor revived by MirrorFace; loaded into memory via the ANELLDR side-loading chain and used for command-and-control over web protocols.
Backdoor associated with APT10/Earth Kasha reporting; also referenced in FBI FLASH as UPPERCUT/ANEL.
Malware installed via malicious Word templates and executed through signed binary abuse and WMI proxy execution during Operation AkaiRyū.
Malware used by MirrorFace in long-running cyber-espionage activity targeting Japan (as referenced alongside NOOPDOOR).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.