Executive Summary
-
Actor: China-linked APT group (no conclusive attribution yet).
-
Target: Military company in the Philippines.
-
Framework: EggStreme — modular, fileless, memory-resident malware.
-
Campaign Duration: April 2024 – June 2025.
-
Objective: Long-term espionage, surveillance, data exfiltration.
Technical Analysis
Key Modules:
-
EggStremeFuel → Initial loader (DLL sideloading).
-
EggStremeLoader → Persistence + encrypted payload handling.
-
EggStremeReflectiveLoader → Injects EggStremeAgent in memory.
-
EggStremeAgent → Main backdoor, 58+ commands.
-
EggStremeKeylogger → Credential & keystroke capture.
-
EggStremeWizard → Secondary backdoor, redundancy.
Attack TTPs:
-
DLL sideloading via trusted binaries.
-
Fileless execution (payloads decrypted in RAM).
-
Privilege escalation via SeDebugPrivilege.
-
Long-term persistence via hijacked services.
Indicators of Compromise (IOCs)
-
DLL names:
mscorsvc.dll,xwizards.dll. -
Abused binaries:
WinMail.exe. -
Paths:
%APPDATA%\Microsoft\Windows\Windows Mail\ -
Protocol: Encrypted gRPC/mTLS for C2 comms.
Detection & Challenges
-
Fileless payloads → bypass traditional AV.
-
DLL sideloading → blends with trusted apps.
-
Long-term dwell time → stealth surveillance.
Defense & Mitigation
-
EDR/XDR with in-memory scanning.
-
Behavioral monitoring → unusual DLL loads, service registry edits.
-
Network defense → watch gRPC anomalies, C2 beaconing.
-
Least privilege enforcement → restrict SeDebugPrivilege.
-
Harden services → disable unused Windows services.
-
Threat intelligence sharing with defense sector peers.
Geopolitical Implications
-
Targeting a Philippines military company fits into the South China Sea strategic contest.
-
Likely long-term espionage rather than short-term disruption.
-
Shows continued China-linked investment in modular, stealth APT frameworks.
CyberDudeBivash Recommendations
-
Military & defense contractors should prioritize runtime behavioral EDR/XDR.
-
Integrate SBOM + supply chain scanning to prevent similar sideloading attacks.
-
Conduct threat hunting campaigns for DLL sideloading activity.
-
Adopt Zero Trust architectures for high-value military/defense networks.