Loading malware…
AIRBREAK, also known as Orz, is a custom JavaScript backdoor associated with the China-nexus espionage activity tracked as Leviathan, TEMP.Periscope, MUDCARP, and APT40. It has been used in long-running cyber-espionage operations targeting maritime and naval interests, defense contractors, government entities, universities with military ties, and related organizations, particularly in the United States, Western Europe, and South China Sea-focused contexts.
AIRBREAK functions as an initial-stage backdoor and reconnaissance implant on Windows systems. Documented capabilities include collecting process listings, proxy configuration, and browser version information; performing registry operations; modifying registry settings to reduce visibility; enumerating drives; executing commands and JavaScript; transferring files; and communicating over HTTP using GET and POST requests. Some variants have used public web services such as Technet and Pastebin as command-and-control channels, in addition to attacker-controlled or compromised web infrastructure.
Certain AIRBREAK variants include or work with auxiliary loaders such as MockDll and SeDll. MockDll has been observed using process hollowing and regsvr32 to launch additional payloads, while SeDll decrypts and executes the JavaScript backdoor. AIRBREAK has also been delivered by Windows executables masquerading as benign tools and executed via Windows scripting components. In broader intrusion chains, it has been deployed through spearphishing campaigns using malicious attachments, macro-enabled Office documents, crafted Publisher files, and exploits including CVE-2017-0199 and CVE-2017-8759. These campaigns often used social engineering themes relevant to defense, maritime, or research targets and were followed by additional payload delivery, including Cobalt Strike.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
First-stage backdoors such as AIRBREAK, FRESHAIR, and BEACON are used before downloading other payloads.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Tools Nanhaishu, Orz, SeDll, Cobalt Strike, GreenCrash, AIRBREAK, BlackCoffee, China Chopper, FUSIONBLAZE, HOMEFRY, MURKYTOP, Metasploit / Meterpreter, ScanBox, Derusbi Trojan, Derusbi, Metasploit
22 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.
This definition in turn downloads a VBScript favicon.ico file, which then creates and runs two JavaScript files in the %TMP% directory.
Examples include Cobalt Group using a JavaScript backdoor to launch cmd.exe, NanoCore using JavaScript files, Orz executing commands with JavaScript, Patchwork using JavaScript code, and SQLRat executing JavaScript on the host system.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
Use simple obfuscation such as base64, gzip compression, and insertion of garbage characters
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.
Its functionality includes: GET request to a URL POST request to a URL
6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Gathers proxy information from victim systems.
Backdoor that gathers proxy information from victims.
Backdoor malware capable of gathering a process list from the victim.
Malware with an embedded DLL, MockDll, that uses Process Hollowing and regsvr32 to execute another payload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.