Loading malware…
SysUpdate is a modular backdoor family associated primarily with the Chinese espionage group APT27, also known as Emissary Panda and Iron Tiger. It has also been referred to as Soldier, FOCUSFJORD, and HyperSSL in overlapping reporting, reflecting naming differences across vendors and variants. The malware has been documented as a Windows and Linux backdoor used for long-term access, command execution, file and process management, screenshot capture, host reconnaissance, persistence, and command-and-control communications. Reported variants can hide artifacts, store encoded configuration data in the Windows Registry, create services for persistence, use WMI for execution, exfiltrate data over established C2 channels, and encode C2 traffic with Base64. SysUpdate has also been observed using DLL sideloading through legitimate but vulnerable executables and being signed with stolen digital certificates to reduce detection.
Operational reporting links SysUpdate to APT27 campaigns targeting government, healthcare, technology, education, travel, energy, and other sectors, including activity focused on the Middle East. A related variant described as HyperSSL has been characterized as sideloading an encrypted payload that is decrypted and executed in memory. Across APT27 tradecraft, SysUpdate fits a broader espionage toolkit used for persistence and post-compromise control alongside families such as HyperBro and PlugX.
Separate reporting has also used the name Soldier for a distinct multistage .NET backdoor associated with the Iranian threat actor Mint Sandstorm, also known as PHOSPHORUS or Charming Kitten. That implant has been described as capable of downloading and executing additional tools, uninstalling itself, and using actor-controlled domain-rotation infrastructure. In older surveillance tooling, Soldier was additionally used as the name of a second-stage Hacking Team implant within the Remote Control System architecture. Because the name Soldier is overloaded across multiple unrelated malware lineages, SysUpdate is the most precise and widely recognized display name for the APT27-associated malware family represented here.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"The attackers also attempted to install their own version of SysUpdate..." | Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 | "The attackers also attempted to install their own version of SysUpdate..."
"The attackers also attempted to install their own version of SysUpdate..." | Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065
"The attackers also attempted to install their own version of SysUpdate..." | Previously, Eset reported that about five APT groups has been exploiting the four Exchange vulnerabilities - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 ... Security firm Volexity spotted hackers targeting Exchange servers on Jan. 3, when it saw CVE-2021-26855 being exploited.
These intrusions exploited the Microsoft SharePoint vulnerability CVE-2019-0604 to install web shells and FOCUSFJORD payloads... UNC215 often uses FOCUSFJORD for the initial stages of an intrusion, and then later deploys HYPERBRO... | "These intrusions exploited the Microsoft SharePoint vulnerability CVE-2019-0604 to install web shells and FOCUSFJORD payloads at targets in the Middle East and Central Asia."
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The aeCERT report identifies a new variant within the HyperBro family called HyperSSL. This tool is said to side-load an encrypted payload that is then decrypted and executed in memory.
Soldier is a multistage .NET backdoor with the ability to download and run additional tools and uninstall itself. Like Drokbk, Soldier C2 infrastructure is stored on a domain rotator on a GitHub repository operated by Mint Sandstorm.
Soldier is a multistage .NET backdoor with the ability to download and run additional tools and uninstall itself. Like Drokbk, Soldier C2 infrastructure is stored on a domain rotator on a GitHub repository operated by Mint Sandstorm.
SysUpdate Modular backdoor used by APT27 for persistence, command execution, file and process management, screenshot capture, and C2 communications; supports Windows and Linux.
These intrusions exploited the Microsoft SharePoint vulnerability CVE-2019-0604 to install web shells and FOCUSFJORD payloads... UNC215 often uses FOCUSFJORD for the initial stages of an intrusion, and then later deploys HYPERBRO...
37 distinct techniques documented for this family, organized by ATT&CK tactic.
As for the distribution vector of the post-leak samples we analysed, in at least two cases, we detected the spyware in an executable file disguised as a PDF document. The names of the files suggest the malware was spread via spear-phising emails sent to high-profile targets such as diplomats
the operators use webhook.site for C2 and create scheduled tasks for persistence.
the operators use webhook.site for C2 and create scheduled tasks for persistence.
Collected data is packed, encrypted and stored in the registry and later sent to the C&C server
the operators use webhook.site for C2 and create scheduled tasks for persistence.
A malicious DLL decrypts Shikata Ga Nai shellcode, which installs, persists (registry/service), and process-hollows the next stage.
In some cases the attackers modified a clean installer in about 90 minutes, inserting obfuscated JavaScript into electron-main.js.
A malicious DLL decrypts Shikata Ga Nai shellcode, which installs, persists (registry/service), and process-hollows the next stage.
A malicious DLL decrypts Shikata Ga Nai shellcode, which installs, persists (registry/service), and process-hollows the next stage.
The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.
MITRE ATT&CK® Tactic Technique ID ... System Network Configuration Discovery T1016
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
MITRE ATT&CK® Tactic Technique ID ... System Network Connections Discovery T1049
The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
The defendants ... conducted unauthorized intrusions into victim networks by exploiting software vulnerabilities, conducting internal reconnaissance, and deploying malware such as PlugX to establish persistent access. The indictment alleges that the group stole data from compromised networks and transferred it to servers under their control.
Collected data is packed, encrypted and stored in the registry and later sent to the C&C server
The Drokbk backdoor issues a web request to obtain the contents of a README file on a Mint Sandstorm-controlled GitHub repo.
Starting closest to the actors, we see connections from Chinanet Backbone or Alibaba establishing tunnels to the management VPN nodes at DigitalOcean. From these, they create tunnels to operational nodes, which they use to SSH into the malware controllers.
Drobkbk and Soldier both use Mint Sandstorm-controlled GitHub repositories to host a domain rotator containing the operators’ C2 domains.
Soldier is a multistage .NET backdoor with the ability to download and run additional tools
C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding... APT19 HTTP malware variant used Base64 to encode communications to the C2 server... APT33 has used base64 to encode command and control traffic.
112 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Linux-targeting malware/backdoor that disguises itself as a legitimate system service, performs host reconnaissance (e.g., runs the GNU/Linux id command), and establishes encrypted C2 communications across multiple protocols using complex cryptographic routines.
... SysUpdate ... (v1.2→v1.3) ...
SysUpdate (v1.2→v1.3)
Custom modular backdoor used by APT27 for persistence, command execution, file and process management, screenshots, and C2; later versions added Linux support and DNS TXT-based C2.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.