Quarian
Quarian is a little-known backdoor malware family, including a version 3 variant also referred to as Turian. Reporting in the provided content links Quarian to Chinese-speaking espionage activity and assesses with medium to high confidence that some Quarian/PlugX operations were conducted by the CloudComputating group, also known as BackdoorDiplomacy or Faking Dragon. Quarian was observed in attacks against Middle Eastern and African governments in 2020, and later in a long-running intrusion affecting an ISP in West Asia where victim machines had been infected with Quarian v3 since 2022. In that case, attackers used existing Quarian access to deploy the modular in-memory QSC framework beginning on October 10, 2023, and also deployed the GoClient Golang backdoor. Quarian has been delivered via DLL sideloading chains, including abuse of legitimate executables such as mobpopup.exe renamed to winsecunicity.exe to sideload pc2msupp.dll, and Sophos observed similar sideloading chains associated with suspected Quarian loader deployment. Another reported infection chain involved exploitation of Microsoft Exchange CVE-2020-0688 followed by a ChinaChopper web shell to deploy Quarian and PlugX. Quarian was also observed modifying Windows services such as swprv and rasauto so ServiceDll values pointed to QSC loader DLLs including swprr.dll and rasautosvc.dll. A reported Quarian sample located at C:\Windows\SysWOW64\appmgmt.dll had MD5 97b0a8e8d125e71d3d1dd8e241d70c5b and was configured to use proxy.oracleapps.org, infrastructure previously linked to BackdoorDiplomacy. The malware is associated in the content with government and telecom/ISP targeting in the Middle East, Africa, and West Asia, and with post-compromise activity including persistence, loader deployment, and enabling follow-on espionage tooling.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In one case, we could see that this variant was deployed following exploitation of the CVE-2020-0688 vulnerability on the network of a government entity. This vulnerability, which was publicly reported in February 2020, allows an authenticated user to run commands as SYSTEM on a Microsoft Exchange server. | Quarian is a little-known malicious program... we noticed a new variant that was used during several attacks on Middle Eastern and African governments during 2020.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sophos MDR hunters observed the same sideloading chains described in the BitDefender report to deploy a Merlin C2 Agent and a suspected loader for the Quarian backdoor.
Our investigation found that the target machines had been infected with the Quarian backdoor version 3 (aka Turian) since 2022, and the same attackers had used this access to deploy the QSC framework starting on October 10, 2023.
Our investigation found that the target machines had been infected with the Quarian backdoor version 3 (aka Turian) since 2022, and the same attackers had used this access to deploy the QSC framework starting on October 10, 2023.
Quarian is a little-known malicious program... we noticed a new variant that was used during several attacks on Middle Eastern and African governments during 2020.
Techniques & procedures
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
3 techniques
Execution
The Command Shell module launches % windir % \ system32 \ cmd . exe as a shell using the CreateProcess API, and data is written to and read from the shell using pipes.
Persistence
1 technique
Persistence
Stealth
1 technique
Stealth
IOCs tracked for this family
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor referenced as the suspected intended payload of a sideloading chain, though execution was prevented before confirmation.
A backdoor referenced as the payload targeted for deployment via a suspected loader in a sideloading chain.
Backdoor referenced as a payload in suspected loader/sideloading chains (payload deleted before execution in this case).
A backdoor used as the initial access and deployment mechanism for QSC and GoClient. It was used to launch command shells, execute batch scripts, copy payloads, and run additional tools during post-compromise activity.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.