Loading malware…
EAGERBEE, also known as Thumtais, is a Windows malware framework used in targeted cyberespionage operations linked to China-nexus activity. It has been described both as a downloader and as a backdoor because it establishes command-and-control communications, retrieves additional components from remote infrastructure, and executes downloaded payloads directly in memory. Campaigns using EAGERBEE have been observed since at least 2022 against government entities, foreign affairs organizations, internet service providers, and other high-value targets across Asia, the Middle East, and Russia.
EAGERBEE is developed in Microsoft Visual C/C++ and supports both outbound callback communications and passive listening modes. In reverse mode, the implant initiates contact to its controller; in listen mode, it opens a local port and waits for inbound operator connections. Variants support direct TCP over IPv4 and IPv6, optional SSL or TLS, proxy awareness, and encrypted storage or transmission of configuration and communications data. Anti-analysis and evasion features reported for the family include runtime import resolution, string and configuration decryption, VMProtect obfuscation in some samples, and use of alternate configuration files to conceal command-and-control destinations. Some newer variants were also observed disrupting or blackholing communications to antivirus vendor infrastructure inside victim networks.
The malware collects host profiling data such as computer name, operating system version, processor architecture, network addressing, and related system metadata. After establishing communications, EAGERBEE can receive and execute additional PE payloads in memory and has been observed loading a plugin orchestrator that manages modular capability DLLs. Documented plugin functionality includes file and directory enumeration and manipulation, process enumeration and termination, service management, network connection enumeration, command execution, reflective loading or injection of executables and DLLs, and enabling remote desktop access. Persistence has been observed through Windows services, and deployment has frequently relied on DLL sideloading or service abuse to inject the backdoor into legitimate processes.
Operational reporting links EAGERBEE to multiple China-aligned intrusion sets rather than a single exclusive operator. Publicly reported overlaps associate its use with REF5961, Tonto Team, and other clusters with possible ties to TA428 or LuckyMouse, while some research assesses a relationship to the CoughingDown threat group based on code and infrastructure overlap. EAGERBEE has also figured prominently in broader espionage campaigns such as Crimson Palace, where updated variants were used alongside other implants and open-source tooling to maintain persistence, evade defenses, and support post-compromise operations in government environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Two of these organizations were breached via the infamous ProxyLogon vulnerability (CVE-2021-26855) in Exchange servers, after which malicious webshells were uploaded and utilized to execute commands on the breached servers. | In our recent investigation into the EAGERBEE backdoor, we found that it was being deployed at ISPs and governmental entities in the Middle East.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
EAGERBEEは、Microsoft Visual C/C++で開発されたダウンローダ型マルウェアであり、C2サーバからダウンロードしたファイルをメモリ上で実行する機能を備えています。
EAGERBEEは、Microsoft Visual C/C++で開発されたダウンローダ型マルウェアであり、C2サーバからダウンロードしたファイルをメモリ上で実行する機能を備えています。
EAGERBEEは、Microsoft Visual C/C++で開発されたダウンローダ型マルウェアであり、C2サーバからダウンロードしたファイルをメモリ上で実行する機能を備えています。
EAGERBEEは、Microsoft Visual C/C++で開発されたダウンローダ型マルウェアであり、C2サーバからダウンロードしたファイルをメモリ上で実行する機能を備えています。
In our recent investigation into the EAGERBEE backdoor, we found that it was being deployed at ISPs and governmental entities in the Middle East.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
0x1D (29) Start the command shell (cmd.exe). The module can also run cmd.exe by injecting its code into the process C:\Windows\System32\dllhost.exe. Read data from the command shell and send it to the C2 server.
c:\programdata\microsoft\vmware\vmnat\vmtools\instsrv.exe vmnattools c:\programdata\microsoft\vmware\vmnat\vmtools\srvany.exe
It uses a known technique to try to crash EDR processes, by creating a Registry key named SophosFileScanner.exe in the path SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
When we found the backdoor in the infected system, it was named dllloader1x64.dll.
Upon establishing a connection to C2, The malware downloads executable files from C2... then extracts the entry point and modifies memory protections to allow execution using the VirtualProtect API. Payload execution in the same process
change the creation, last access and write time, timestamp of the file to "1/8/2019 9:57"
the HUI loader (msedge_elf.dll), which de-obfuscated the file log.ini to reveal a Cobalt Strike reflective Loader
attrib . exe + s + h + a C : \ users \ public \ ntusers0 . dat ... attrib . exe + s + h + a system32 \ tsvipsrv . dll
Thumtaisは、IKE and AuthIP IPsec Keying Modules(IKEEXT)サービスを悪用したDLLハイジャックまたは正規のアプリケーションを利用して、DLLサイドローディングによって実行されます。
The backdoor retrieves the proxy host and port information for the current user by reading the registry key Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer.
The module also collects user accounts associated with the processes.
Network Manager This plugin lists the network connections in the system... Get information about the list of IPv4 and IPv6 TCP and UDP connections
It then collects details about all running processes on the system, including: Process identifiers; The number of execution threads started by each process; The identifier of the parent process; The fully qualified path of each process executable.
The malware gathers key information about the compromised system: The computer's name is obtained using the GetComputerNameW function... The processor architecture information is acquired using the GetNativeSystemInfo function... The ProductName, EditionID, and CurrentBuildNumber are extracted from the designated registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion
Reverseモードでは、マルウェアが実行されるとコールバック通信を発生させ、感染端末からC2サーバへ接続します。一方、Listenモードでは、感染端末のポートを開放し、C2サーバからの通信を待ち受けます
0x0D (13) Download a file from the specified URL and write to the specified file path.
The malware has the capability to detect the presence of an HTTP proxy configuration on the host machine by inspecting the ProxyEnable registry key within Software\Microsoft\windows\CurrentVersion\Internet Settings . If this key value is set to 1 , the malware extracts the information in the ProxyServer key.
High prioritization of evasive tactics and tools: ... overwriting ntdll.dll in memory to unhook the Sophos AV agent process from the kernel, abusing AV software for sideloading... Deployment of new EAGERBEE malware variants with updated capability of modifying packets to disrupt security agent network communications.
76 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor framework with modular components for payload deployment, filesystem enumeration, and command execution; updated variant targeting ISPs and government entities in the Middle East.
A modular backdoor framework used to compromise targets, execute commands, enumerate file systems, and deploy additional payloads.
A Chinese-nexus malware family whose newer variants were used to infect services, establish C2, and modify DNS traffic via WinDivert to block communications with security vendor infrastructure.
Referenced as malware previously seen in related Cluster Alpha activity that could potentially be used to block endpoint telemetry and updates.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.