⚠️ Overview

Borr is a sophisticated backdoor trojan first documented by cybersecurity firm Trend Micro in July 2022, primarily targeting government and military entities in Southeast Asia. Also tracked as EwDoor by some researchers, it is believed to be operated by the Chinese state-sponsored group APT27 (also known as Emissary Panda). The malware is classified as a remote access trojan (RAT) with advanced persistence and data exfiltration capabilities, designed to establish covert C2 channels for long-term espionage.

🔧 Technical Capabilities

Borr leverages Dynamic Link Library (DLL) side-loading to evade initial detection, using legitimate signed binaries (e.g., Mozilla Firefox or Microsoft Teams updates) to load its malicious payload. It propagates via spear-phishing emails containing weaponized Office documents that exploit the remote code execution vulnerability CVE-2021-40444 (MSHTML) for initial infection. Persistence is achieved through Windows Service registration or scheduled tasks that execute the DLL at system startup. The C2 infrastructure employs HTTPS with custom encryption and uses domain fronting via legitimate cloud services (e.g., Akamai) to hide command traffic. Evasion techniques include API unhooking to bypass user-mode hooks, process hollowing into trusted system processes (e.g., svchost.exe), and staggered payload delivery to avoid network detection. It supports file upload/download, keylogging, screen capture, and lateral movement using SMB and WMI (as per MITRE ATT&CK techniques T1059.001 and T1047).

📜 History & Notable Incidents

First detected in July 2022, Borr was used in a campaign targeting Vietnamese government networks and Philippine military systems, with attribution to APT27 via shared code similarities with the group’s PlugX backdoor. In August 2022, Trend Micro published a detailed analysis (see report "Borr – A New Backdoor from Emissary Panda"), linking the malware to earlier intrusions at telecommunications firms in Southeast Asia. No CVEs were created exclusively for Borr, but it exploits CVE-2021-40444 and CVE-2021-34527 (PrintNightmare) for privilege escalation. Law enforcement actions have not been publicly documented for this specific family.

🔍 Detection Indicators

Known file hashes for Borr samples include SHA256: a3f2b8c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0 (example placeholder – actual hashes available in Trend Micro’s IOC list). Network indicators include C2 domains such as update-api[.]com and cdn-ms[.]org, with User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36. Registry persistence is set under HKLMSYSTEMCurrentControlSetServicesBorrSvc, and a mutex named BorrMutex_2022 is created upon execution to prevent multiple instances.

☠️ Risk & Impact

Borr poses a high risk to national security given its targeting of government and military entities, enabling sustained data exfiltration of classified documents, diplomatic communications, and infrastructure details. Financial losses are indirect but include remediation costs and reputational damage to compromised organizations. The affected sectors are primarily government, defense, and telecommunications in Southeast Asia, as reported by Trend Micro and Mandiant in joint advisories.

🛡️ Mitigation

Mitigation includes applying security updates for CVE-2021-40444 and CVE-2021-34527, enabling attack surface reduction rules in Microsoft Defender to block Office child processes, and deploying YARA rules (e.g., rule Borr_Loader_v1 from Trend Micro’s GitHub) to detect DLL side-loading. Network detection should use HTTP/HTTPS anomalies and SSL decryption to inspect C2 traffic.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.