Loading malware…
DarkNights, also known as DarkNimbus, is Android malware associated with the China-aligned intrusion ecosystem surrounding TheWizards. Reporting links it to infrastructure used by TheWizards and to Sichuan Dianke Network Security Technology (UPSEC), which has been assessed as a supplier or enabling party within that ecosystem. Trend Micro has referred to the malware as DarkNimbus, while ESET tracks it as DarkNights.
DarkNights has been observed being delivered to Android devices through hijacked software update traffic, including malicious update responses targeting Tencent QQ on Android. This places it within an adversary-in-the-middle-enabled delivery model in which legitimate application update requests are redirected to attacker-controlled infrastructure that serves trojanized content. The malware’s documented role in this ecosystem is Android compromise via fake or manipulated updates rather than broad commodity distribution.
Available high-confidence reporting in this context does not provide sufficient technical detail to characterize DarkNights more specifically by family class or to enumerate its full post-compromise feature set. Its known significance lies in its use as an Android payload within a China-aligned update-hijacking operation connected to TheWizards-related infrastructure and overlapping supplier relationships involving UPSEC.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Another noteworthy tool… is DarkNights, which is also called DarkNimbus by Trend Micro…”
“Another noteworthy tool… is DarkNights, which is also called DarkNimbus by Trend Micro…”
1 distinct technique documented for this family, organized by ATT&CK tactic.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android malware associated in reporting with infrastructure overlaps; served as a malicious update for Android Tencent QQ from infrastructure also used by TheWizards.
Malware (also referred to as DarkNimbus) attributed to Earth Minotaur; described as being served to updating Android applications via a hijacking server, with UPSEC (Sichuan Dianke Network Security Technology) identified as supplier.
Android (and also referenced as Windows) malware family delivered via hijacked update instructions; observed as a malicious Android plugin (ZIP containing classes.dex) served to Tencent QQ Android update mechanism from attacker infrastructure.
Named as part of TheWizards APT toolkit in a comparative section about China-aligned AitM-capable groups.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.