Loading malware…
Emissary is a Windows remote access trojan associated with the Lotus Blossom espionage cluster and closely related to the Elise malware lineage. Samples date back to at least 2009, indicating a long-running and actively maintained intrusion capability used in cyber-espionage operations. Reported targeting has centered on Taiwan and Hong Kong, particularly government, higher education, military-related, and high-technology organizations, with lures and decoy material commonly aligned to Traditional Chinese-speaking victims.
Emissary is designed to establish and maintain a foothold on compromised systems and provide operators with core post-compromise control. Documented capabilities include remote shell access, execution of operator-supplied commands, file exfiltration, and downloading and executing additional payloads. It also performs host and network reconnaissance, including use of native commands such as ipconfig /all and net start to collect network configuration and service information. Some versions also gathered broader host details through standard Windows utilities.
The malware evolved substantially across multiple versions, with changes to configuration storage, command handling, persistence, and evasion. Observed persistence mechanisms include Registry Run keys and service-based installation or hijacking. Some variants used rundll32 for execution through autorun entries, while others were capable of configuring themselves as a service. Emissary has also been observed injecting its DLL into a newly spawned Internet Explorer process, reflecting process-injection tradecraft intended to blend malicious activity with legitimate processes.
Emissary command-and-control communications have used encrypted or obfuscated exchanges, including XOR-based protection and session material derived from server responses to secure subsequent traffic. Development over time shows repeated efforts to reduce detection, including recompilation without major code changes, string obfuscation, command-structure changes, and oversized padded components intended to interfere with antivirus scanning limits.
Operational reporting links Emissary to Lotus Blossom activity and notes overlap with Elise-related infrastructure and tooling. Delivery has historically included spearphishing with decoy documents, and later operations also used compromised legitimate websites to serve malware. Emissary remains notable as a long-lived espionage implant focused on stealthy access, follow-on payload delivery, and data theft in strategically selected Windows environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
...to deploy another trojan related to Elise codenamed Emissary.
CVE-2018-0802 and CVE-2017-11882: Critical memory corruption vulnerabilities in the legacy Microsoft Office Equation Editor (EQNEDT32.EXE) used extensively during “Spring Dragon” campaigns...
CVE-2018-0802 and CVE-2017-11882: Critical memory corruption vulnerabilities in the legacy Microsoft Office Equation Editor (EQNEDT32.EXE) used extensively during “Spring Dragon” campaigns to deliver Elise and Emissary Trojan payloads...
...spear-phishing campaigns exploiting Microsoft Office vulnerabilities like CVE-2012-0158... / CVE-2012-0158: A foundational vulnerability in Microsoft Office ActiveX controls used for several years...
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
...to deploy another trojan related to Elise codenamed Emissary.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Also new is the actors’ use of compromised legitimate Taiwanese websites to serve their malware, including the official website of the Democratic Progressive Party.
Until that publication, according to our research Emissary was updated roughly every two years... In addition to the malware evolution, the actors also shifted from solely spear-phishing targets with attachments to also compromising legitimate websites to host malware.
Emissary is still able to carry out most tasks desired by threat actors: exfiltration of files, ability to download and execute additional payloads, and gain remote shell access.
Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
The initial loader Trojan writes Emissary to %SYSTEM%\WSPsvc.dll and installs it as a service...
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
The initial loader Trojan writes Emissary to %SYSTEM%\WSPsvc.dll and installs it as a service...
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
For version 5.1 the malware author took out the exception handling in the Upload File command and obfuscated two strings within the Trojan to avoid detection.
...the Loader Trojan (Syncmgr.dll) appending junk data to the end of the Emissary DLL file to make incredibly large files. The reason for creating such large files is to trick antivirus applications into not scanning the file...
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
The malware performs initial system information gathering... NET START
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
The initial gathering relies on a combination of the following commands executed by the command prompt: ... NET START ...
The malware performs initial system information gathering... NET LOCALGROUP ADMINISTRATORS
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information. | Multiple entries explicitly state use of the Windows systeminfo command, e.g., 'BlackEnergy has used Systeminfo to gather the OS version...' and 'OilRig has run hostname and systeminfo on a victim.'
Many entries describe XOR, XOR/ADD, bitwise NOT and XOR, ROR plus XOR, hexadecimal encoding after encryption, and custom encoding/obfuscation of HTTP traffic or beacons.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
Emissary is still able to carry out most tasks desired by threat actors... and gain remote shell access.
we’ve found almost exclusive use of Dynamic DNS (DDNS) domains with only one purchased from a Chinese reseller.
103 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
27 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Trojan/backdoor referenced as delivered by Lotus Blossom via invitation-themed phishing lures (historical reporting).
Remote access implant used alongside Elise; executed via legitimate Windows binaries (e.g., rundll32) indicating LOLBin tradecraft and tool refinement.
A trojan related to Elise, deployed via spear-phishing and exploiting Microsoft Windows OLE flaw.
Executes ipconfig /all to enumerate network configuration.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.