Talos Details DLL-Sideloading Campaign Using RainyDay, Turian and a New PlugX Variant
Summary
Talos analyzed a campaign active since 2022 targeting telecom and manufacturing organizations in Central and South Asia. Its new PlugX variant shares loader techniques and configuration traits with RainyDay and Turian; Talos assesses a Naikon link with medium confidence
Key points
- The campaign targeted telecommunications and manufacturing organizations in Central and South Asian countries and has been active since at least 2022.
- RainyDay, Turian and the new PlugX variant use DLL search-order hijacking with legitimate applications to load malicious code.
- Their loaders share decryption techniques and RC4 keys; the PlugX variant also uses a RainyDay-like configuration format.
- Talos assesses with medium confidence that the campaign is linked to Naikon; shared targeting and technical overlaps suggest a possible connection with BackdoorDiplomacy, but Talos says the link is not conclusive.
- The customized PlugX can use keylogging, network and port-mapping plugins, HTTPS command-and-control, and privilege escalation.
- A keylogger log found by Talos indicated persistence in a victim environment from late 2022 through December 2024.
Article Details
- Attack Vectors
- DLL search-order hijacking and sideloading of malicious loaders through legitimate applications, including the Mobile Popup Application.
- Loaders read encrypted shellcode files from the same directory as the abused executables, decrypt and decompress the payload, and execute it in memory.
- RainyDay and PlugX unpack payloads into memory and inject code into the calling process; Turian injects into a new legitimate process, identified as wabmig.exe or explorer.exe.
- The PlugX variant uses HTTPS for recurring command-and-control connections and includes a keylogger plug-in.
- The PlugX variant can acquire SeDebugPrivilege and SeTcbPrivilege, hide its malicious service within services.exe, and run plug-ins including KeylogDump, Nethood, and PortMap.
- Defensive Notes
- Cisco Talos recommends Cisco Secure Endpoint to prevent execution of the described malware.
- Cisco Secure Email can block malicious campaign emails; Cisco Secure Firewall, Cisco Secure Network/Cloud Analytics, Cisco Secure Malware Analytics, Umbrella, and Cisco Secure Web Appliance provide detection or blocking capabilities described by the article.
- Cisco Duo provides multi-factor authentication, and Snort Subscriber Rule Set customers can obtain updated rule packs.
- ClamAV detection reported for this threat: Win.Loader.RainyDay-10045411-0.
MITRE ATT&CK
T1055 · Process InjectionRainyDay and PlugX inject code into the calling process; Turian injects into a new process such as wabmig.exe or explorer.exe.T1055.012 · Process HollowingThe PlugX variant hides its malicious service within the services.exe process.T1056.001 · KeyloggingThe PlugX payloads include a keylogger plug-in that records keystrokes.T1071.001 · Web ProtocolsThe PlugX variant communicates with its C2 server over HTTPS.T1134.001 · Token Impersonation/TheftThe PlugX variant attempts privilege elevation and acquires SeDebugPrivilege and SeTcbPrivilege.T1574.002 · DLL Side-LoadingRainyDay, Turian, and the PlugX variant use DLL search-order hijacking to load malicious DLLs through legitimate applications.
People
Threat Actors
Malware
Aira-bodyNaikon employs a variety of backdoors, including Aira-body, Nebulae and RainyDay, along with numerous customized hacking tools to maintain persistence and exfiltrate data from victims' network environments. Notably,Backdoor.Whitebird.1ESET has noted similarities in the network encryption methods of Turian and a backdoor known as Backdoor.Whitebird.1. Bitdefender has suggested that Quarian, Turian and Whitebird may be different versions of theFoundCorebackdoor. This malware was first discovered in 2021 by Bitdefender, and may be tracked by Kaspersky as FoundCore, based on the behavior they describe in their analysis. By combining insights from both researchNebulaeNaikon employs a variety of backdoors, including Aira-body, Nebulae and RainyDay, along with numerous customized hacking tools to maintain persistence and exfiltrate data from victims' network environments. Notably,PlugXHow RainyDay, Turian and a new PlugX variant abuse DLL search order hijackingQuarianTheir primary tool of choice is Turian, believed to be an upgraded version of Quarian. ESET has noted similarities in the network encryption methods of Turian and a backdoor known as Backdoor.Whitebird.1. BitdefenderRainyDayHow RainyDay, Turian and a new PlugX variant abuse DLL search order hijackingTurianHow RainyDay, Turian and a new PlugX variant abuse DLL search order hijacking
Vendors
Bitdefendersimilarities in the network encryption methods of Turian and a backdoor known as Backdoor.Whitebird.1. Bitdefender has suggested that Quarian, Turian and Whitebird may be different versions of the same backdoor.CiscoCisco Talos discovered a new campaign active since 2022, targeting the telecommunications and manufacturing sectors in Central and South Asian countries, delivering a new variant of PlugX.ESETTheir primary tool of choice is Turian, believed to be an upgraded version of Quarian. ESET has noted similarities in the network encryption methods of Turian and a backdoor known as Backdoor.Whitebird.1. BitdefenderKasperskythe RainyDay backdoor. This malware was first discovered in 2021 by Bitdefender, and may be tracked by Kaspersky as FoundCore, based on the behavior they describe in their analysis. By combining insights from bothSymantechacking tools to maintain persistence and exfiltrate data from victims' network environments. Notably, Symantec reported the group has been using the RainyDay backdoor to target telecom operators in several Asian
Products
MicrosoftEdgeUpdateC:\Users\admin\Desktop\Desktop_bak\success_bai\MicrosoftEdgeUpdate.exe\shellcode_xor\dll-MicrosoftEdgeUpdate\Release\2-dll-MicrosoftEdgeUpdate.pdbMobile Popup Applicationbackdoor and newly identified variants of the PlugX backdoor were abusing the same legitimate Mobile Popup Application as RainyDay to load themselves into memory. Second, we observed that the three malware families
Tools
ClamAVClamAV detections are also available for this threat:icmpshC:\vc_code\code_test\26.icmpsh-master(tigong wangzhiban)\shellcodeloader_vs2008\Release\shellcodeloader_vs2008.pdbKeylogDumpprivileges to grant high-level access for its own process. It then retrieves three specific plug-ins: KeylogDump, Nethood and PortMap. Following this, it employs the same techniques as BackDoor.PlugX.38 to hide itsNethoodto grant high-level access for its own process. It then retrieves three specific plug-ins: KeylogDump, Nethood and PortMap. Following this, it employs the same techniques as BackDoor.PlugX.38 to hide its maliciousPortMapaccess for its own process. It then retrieves three specific plug-ins: KeylogDump, Nethood and PortMap. Following this, it employs the same techniques as BackDoor.PlugX.38 to hide its malicious service withinSnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.
Countries
Kazakhstanthis trend. In a recent campaign we observed, Naikon targeted a telecommunications company in Kazakhstan, which borders Uzbekistan — another country previously victimized by BackdoorDiplomacy . PriorUzbekistanrecent campaign we observed, Naikon targeted a telecommunications company in Kazakhstan, which borders Uzbekistan — another country previously victimized by BackdoorDiplomacy . Prior reporting suggests that targeting
Industries
Civil organizationsNaikon is a well-known Chinese-speaking cyber espionage group that has been active since at least 2010. This threat group has primarily targeted government, military, and civil organizations across Southeast Asia. GovernmentNaikon is a well-known Chinese-speaking cyber espionage group that has been active since at least 2010. This threat group has primarily targeted government, military, and civil organizations across Southeast Asia. ManufacturingCisco Talos discovered a new campaign active since 2022, targeting the telecommunications and manufacturing sectors in Central and South Asian countries, delivering a new variant of PlugX.MilitaryNaikon is a well-known Chinese-speaking cyber espionage group that has been active since at least 2010. This threat group has primarily targeted government, military, and civil organizations across Southeast Asia. TelecommunicationsCisco Talos discovered a new campaign active since 2022, targeting the telecommunications and manufacturing sectors in Central and South Asian countries, delivering a new variant of PlugX.