Loading malware…
XBOW is a BIFROST-derived backdoor associated with the BlackTech espionage cluster, particularly the long-running Shrouded Crossbow campaign. It is part of a toolset that also includes BIFROSE and KIVARS, and its functionality is assessed to build on capabilities found in those related backdoors. BlackTech has primarily targeted organizations in East Asia, especially Taiwan, with victim sectors including government, government contractors, and enterprises in the consumer electronics, computer, healthcare, and financial industries.
Shrouded Crossbow has been active since at least 2010 and has used spearphishing emails carrying malicious attachments disguised as documents, often paired with decoy content and right-to-left override filename deception. Within this campaign, XBOW is used as a remote access backdoor for post-compromise control. Reported capabilities inherited from the related BIFROST/KIVARS lineage include downloading and executing files, system interaction, screenshot capture, keylogging support, and broader remote administration functions. XBOW is also notable for a distinctive mutex naming convention that gave Shrouded Crossbow its campaign name.
The malware is part of a broader cyber-espionage ecosystem focused on long-term access and theft of sensitive documents. Its operational use aligns with intelligence collection against public- and private-sector targets rather than disruptive or destructive objectives.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
Shrouded Crossbow employs three BIFROST-derived backdoors: BIFROSE, KIVARS, and XBOW.
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Artificial intelligence is rapidly transforming offensive security from isolated automation into autonomous, multi-agent systems capable of mapping attack surfaces, identifying vulnerabilities, validating exploits, and producing technical reports with minimal human intervention.
Resecurity analyzed how autonomous offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, and Nebula lower the barriers to vulnerability identification and exploitation.
PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services.
Beyond frontier models like Mythos, the report details how modern offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, Ethiack Nebula, and specialized LLMs like CyberStrike-OffSec-35B, have lowered the barriers to vulnerability identification and exploitation.
Beyond frontier models like Mythos, the report details how modern offensive security agents such as T3MP3ST, Strix, CyberStrike, XBOW, PentAGI, PentestGPT, Ethiack Nebula, and specialized LLMs like CyberStrike-OffSec-35B, have lowered the barriers to vulnerability identification and exploitation.
21 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Autonomous AI penetration testing agent that uses LLMs to simulate real-world attacks, identifying a wide range of vulnerabilities and outperforming human experts in some benchmarks.
Listed as a tool used by the BRONZE CANAL threat profile.
A BIFROST-derived backdoor whose capabilities are derived from BIFROSE and KIVARS, used in the Shrouded Crossbow campaign.
A backdoor in the Shrouded Crossbow campaign derived from BIFROST/KIVARS capabilities, notable for its distinctive mutex format beginning with 'zhugeliannu'.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.