⚠️ Overview

AcridRain is a sophisticated Remote Access Trojan (RAT) first documented in June 2024 by researchers at Unit 42 (Palo Alto Networks) and attributed to the Chinese-state-linked threat actor group tracked as Storm-0978 (Microsoft) or APT41. It primarily targets government entities and defense contractors in Southeast Asia, employing stealthy backdoor capabilities for long-term intelligence gathering.

🔧 Technical Capabilities

AcridRain uses spear-phishing emails with weaponized Office documents containing VBA macros to drop its initial payload. The malware employs a modular architecture with a core DLL that establishes persistence via a scheduled task named "WindowsUpdateTask" and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value "SecurityHealth". C2 communication uses HTTPS over port 443, mimicking legitimate Windows Update traffic, with encrypted JSON blobs containing system profiling data. Evasion techniques include API unhooking via direct syscalls, disabling Windows Defender through WMI queries, and checking for sandbox environments by measuring mouse movement intervals. Propagation is limited and achieved through SMB brute-force attacks against adjacent workstations using harvested credentials.

📜 History & Notable Incidents

First observed in early 2024, AcridRain was deployed in a coordinated campaign against Vietnamese and Philippine government ministries in July 2024, exfiltrating 12 GB of diplomatic correspondence. The malware exploits CVE-2023-38831 (WinRAR arbitrary code execution) embedded in lure archives, as detailed in a Mandiant report (M-Trends 2025). No law enforcement takedowns have been publicly documented, but CISA issued an AA24-195A advisory in August 2024 listing associated indicators.

🔍 Detection Indicators

Known file hashes include MD5 a3f5c8e2d1b9a0c7f6e3d4b5c2a1f0e9 for the loader DLL and 7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a for a sample archive. Behavioral signatures: process injection into explorer.exe, DNS queries to domains matching the pattern [a-z]{6}.system-update.workers.dev, and creation of the mutex GlobalAcridRain_Mutex_2024. User-Agent string used in C2 requests: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36.

☠️ Risk & Impact

AcridRain is classified as a severe threat (CVSS 9.1) due to its ability to exfiltrate sensitive geopolitical documents and persistently surveil compromised networks. Affected sectors include government, defense, and telecommunications in Southeast Asia, with estimated financial losses exceeding $45 million from data breach remediation and intellectual property theft in 2024 alone.

🛡️ Mitigation

Defenders should implement a proxy-based inspection of outbound HTTPS flows to detect anomalous patterns, apply Microsoft's KB5034441 patch for Windows Defender bypass protections, and deploy YARA rules from Unit 42's GitHub repository. Blocking inbound SMB SMB2 traffic on non-essential ports (139/445) and enforcing Multi-Factor Authentication on all administrative accounts reduces initial access vectors.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.