DarkNimbus
DarkNimbus is a cross-platform backdoor with Android and Windows variants that has been actively developed since at least 2018. It has been reported as being used by the China-aligned threat cluster Earth Minotaur and has also been linked in reporting to TheWizards/WizardNet-related activity. Since 2023, Cisco Talos has tracked DarkNimbus alongside the MOONSHINE exploit kit, and Trend Micro reported that Earth Minotaur uses MOONSHINE to deliver DarkNimbus to Android and Windows devices, primarily targeting Tibetan and Uyghur communities via malicious links distributed through instant messaging applications, especially WeChat.
On Android, MOONSHINE targets vulnerable Chromium-based browsers and Tencent Browser Server components embedded in apps, including WeChat. In the observed chain, successful exploitation replaced WeChat’s XWalk browser core with a trojanized APK containing DarkNimbus. The Android backdoor uses XMPP for command-and-control via the open-source Smack library and HTTPS for file transfers. Reported capabilities include collection of device information, installed applications, contacts, SMS, call history, GPS data, clipboard contents, browser bookmarks, files, screenshots, photos, and recordings. It also abuses Android Accessibility Service to steal conversations from instant messaging apps shown in the foreground. The broader Android codebase supports collection from DingTalk, MOMO, QQ, Skype, TalkBox, Voxer, WeChat, and WhatsApp, although the MOONSHINE-delivered variant was reported to target WeChat specifically.
The Windows variant is written in C++ and supports host profiling, installed software enumeration, file collection, browsing-history theft, screenshots, keystroke capture, clipboard theft, shell command execution, and browser credential theft. One reported variant communicated with C2 at 117.175.185.81:8001, while another sent the string DKGETMMHOST to 1.1.1.1:8005 to obtain final C2 information.
Cisco Talos also reported DarkNimbus being delivered by DKnife, a seven-component Linux-based adversary-in-the-middle framework used on routers and edge devices since at least 2019 and assessed with high confidence as operated by China-nexus threat actors. DKnife hijacks Windows binary downloads and Android application updates to deliver ShadowPad and DarkNimbus, including a chain in which install.exe (SHA256 2550aa4c4bc0a020ec4b16973df271b81118a7abea77f77fec2f575a32dc3444) contained ShadowPad and DarkNimbus components; TosBtKbd.exe sideloaded TosBtKbd.dll, which then loaded the DarkNimbus DLL TosBtKbdLayer.dll. Talos reported that delivered DarkNimbus samples contacted 1.1.1.1 and that DKnife intercepted that request to provide the real C2 IP. Additional reporting notes overlap between DKnife and WizardNet/Spellbinder infrastructure and tactics, and that DarkNimbus has appeared in campaigns involving ShadowPad and WizardNet.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
9 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Vulnerability Targeted Version CVE-2016-1646 Chrome 39~49
CVE-2020-6418 is the only newer vulnerability included in the version of MOONSHINE exploit kit we observed.
Vulnerability Targeted Version CVE-2018-17480 Chrome 70~73, TBS 44605
Vulnerability Targeted Version CVE-2018-6065 Chrome 62~63
Vulnerability Targeted Version CVE-2018-17463 Chrome 68~69
Vulnerability Targeted Version CVE-2016-5198 Chrome 50
Cisco Talos Intelligence Group recently published details on CVE-2023-3420 vulnerability that targets WeChat. We believe the related exploit is part of the MOONSHINE framework.
Vulnerability Targeted Version CVE-2017-5070 Chrome 56~58
Vulnerability Targeted Version CVE-2017-5030 Chrome 51~55
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
They also discovered an unreported Android backdoor, DarkNimbus, that was used by Earth Minotaur. This backdoor also has a Windows version. Earth Minotaur uses MOONSHINE to deliver the DarkNimbus backdoor to Android and Windows devices, targeting WeChat, and possibly making it a cross-platform threat.
Since 2023, Cisco Talos has tracked the MOONSHINE exploit kit and the DarkNimbus backdoor used to deliver mobile exploits.
"...campaigns involving ShadowPad, DarkNimbus, and the WizardNet backdoor."
...TheWizard APT group, which also deployed DarkNimbus backdoor developed by Earth Minotaur.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
The malicious links led victims to MOONSHINE exploit kit servers, which install backdoors on the victims’ devices.
“DKnife hijacks software downloads and Android app updates to spread ShadowPad and DarkNimbus backdoors.”
Execution
5 techniques
Execution
MOONSHINE uses multiple Chromium exploits to attack instant messaging apps on Android... This gives attackers a great opportunity to exploit these vulnerabilities and install their backdoors.
Persistence
1 technique
Persistence
For the Android variants, the backdoor attempts to contact a Baidu URL "http[:]//fanyi.baidu[.]com/query_config_dk" to retrieve its C2 information. This URL does not return any response from Baidu itself; rather, it serves as a recognizable trigger for DKnife, which intercepts the request and injects the C2 response.
Stealth
3 techniques
Stealth
For the Android variants, the backdoor attempts to contact a Baidu URL "http[:]//fanyi.baidu[.]com/query_config_dk" to retrieve its C2 information. This URL does not return any response from Baidu itself; rather, it serves as a recognizable trigger for DKnife, which intercepts the request and injects the C2 response.
Credential Access
3 techniques
Credential Access
Discovery
3 techniques
Discovery
cmd_10001 Collect mobile device information... / cmd_10001 Collect host information: OS, computername, username, cpu, memory size...
Collection
7 techniques
Collection
Command and Control
3 techniques
Command and Control
DarkNimbus uses the XMPP protocol to communicate with a C&C server... In addition, it communicates to another server via HTTPS; this server is used mainly for file transfers.
Downloads the trojanized XWalk APK from the remote server... / Downloading the “libwcdb.so” file from a remote server for the backdoor to use
For the Android variants, the backdoor attempts to contact a Baidu URL "http[:]//fanyi.baidu[.]com/query_config_dk" to retrieve its C2 information. This URL does not return any response from Baidu itself; rather, it serves as a recognizable trigger for DKnife, which intercepts the request and injects the C2 response.
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cross-platform (Android and Windows) backdoor used for long-term surveillance, delivered via MOONSHINE exploit kit.
Backdoor associated with the Earth Minotaur cluster and also referenced as used by the APT group TheWizards; delivered via DKnife-facilitated traffic manipulation.
Backdoor delivered by the DKnife toolkit in this campaign; specific capabilities not described in the provided content.
A backdoor delivered in a chain where ShadowPad is side-loaded first and then loads DarkNimbus; DKnife supports its C2 by intercepting and rerouting DNS requests to the real C2 infrastructure.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.