Loading malware…
CloudedHope is a low-prevalence custom Linux malware family associated with the China-nexus espionage actor tracked as Murky Panda, also known as Silk Typhoon. It is a statically linked 64-bit ELF executable written in Golang and is designed to operate on Linux-based systems. CloudedHope is characterized as a basic remote access tool that provides attackers with post-compromise remote access and has been used alongside web shells and remote administration methods to support persistence and lateral movement in intrusions.
The malware has been observed in campaigns targeting North American organizations, including government, technology, academic, legal, and professional services entities. It has been deployed after initial access obtained through exploitation of internet-facing systems, including rapid weaponization of n-day and zero-day vulnerabilities. In reported operations, the actor commonly established footholds with web shells and then used CloudedHope as an additional access mechanism on compromised Linux hosts.
CloudedHope incorporates anti-analysis and operational security features. Reported behaviors include environment and command-line checksum checks intended to detect analysis conditions, and its development has been linked to obfuscation using garble. It has also been described as supporting decoy or anti-analysis behavior. In the broader intrusion set where it appears, the associated actor has demonstrated strong operational security through timestamp manipulation, deletion of evidence, and log sanitization. CloudedHope forms part of an espionage-oriented toolset used to maintain covert access to targeted environments rather than for disruptive or destructive effects.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The adversary also has access to the low-prevalence custom malware family CloudedHope. CloudedHope is a statically linked 64-bit ELF executable developed in Golang and designed to target Linux-based systems... The executable implements basic remote access tool (RAT) functionality while leveraging multiple anti-analysis and OPSEC measures...
Other infection pathways include exploitation of known security flaws in Citrix NetScaler ADC and NetScaler Gateway (CVE-2023-3519) and Commvault (CVE-2025-3928).
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The adversary also has access to the low-prevalence custom malware family CloudedHope. CloudedHope is a statically linked 64-bit ELF executable developed in Golang and designed to target Linux-based systems... The executable implements basic remote access tool (RAT) functionality while leveraging multiple anti-analysis and OPSEC measures...
4 distinct techniques documented for this family, organized by ATT&CK tactic.
The executable implements basic remote access tool (RAT) functionality while leveraging multiple anti-analysis and OPSEC measures, including checksum-based comparisons for environment variables and command-line arguments as well as a decoy action to perform should these checksum-based comparisons fail.
The executable implements basic remote access tool (RAT) functionality while leveraging multiple anti-analysis and OPSEC measures, including checksum-based comparisons for environment variables and command-line arguments as well as a decoy action to perform should these checksum-based comparisons fail.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Golang malware used to facilitate remote access in cloud/enterprise intrusions, deployed alongside web shells after exploitation of vulnerabilities.
Custom Linux-focused remote access trojan used for information theft/espionage, written in Go, with anti-analysis measures and decoy actions when it detects analysis.
A custom 64-bit ELF Golang remote access tool (RAT) with anti-analysis/OPSEC features (e.g., timestamp modification and indicator deletion) to maintain covert access.
Custom Linux remote-access malware used to maintain access and execute remote actions on compromised systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.