⚠️ Overview

BravoNC is a lightweight, modular backdoor malware first documented in early 2020 by the Chinese security firm Qi-AnXin as part of a campaign targeting government and defense organizations in Southeast Asia. It is attributed to the advanced persistent threat (APT) group tracked as TA428 (also known as CactusPete or Earth Aru), which is suspected to have ties to Chinese state-sponsored cyber espionage operations. BravoNC falls under the category of a Remote Access Trojan (RAT) and is often deployed as a second-stage payload following initial exploitation of public-facing web servers or spear-phishing emails. According to MITRE ATT&CK (ID S1095), BravoNC is a custom tool that communicates via HTTP/HTTPS and supports encrypted command-and-control (C2) channels.

🔧 Technical Capabilities

BravoNC uses a modular architecture with plugins for file upload/download, keylogging, screen capture, and registry manipulation. Propagation is achieved through lateral movement using SMB (Server Message Block) and WMI (Windows Management Instrumentation) after initial access via vulnerabilities such as CVE-2020-0688 (Microsoft Exchange Server remote code execution) or brute-forcing weak credentials. The malware establishes persistence by creating a scheduled task or Windows service named “BravoNCsvc” and modifies the HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionRun registry key. To evade detection, it employs API hashing, string obfuscation, and periodically checks for sandbox artifacts like known forensic tool processes or low system resources. C2 infrastructure uses domain-generation algorithms (DGAs) and leverages commonly used ports (443, 80) to blend with legitimate traffic, with data exfiltrated over HTTPS encrypted with a custom XOR-based cipher.

📜 History & Notable Incidents

BravoNC was first observed in a campaign dubbed “Operation Buoyant” by Trend Micro in March 2020, targeting foreign ministries and maritime research institutes in Vietnam and the Philippines. In 2021, a variant was used in a series of attacks against telecommunications companies in Myanmar, exploiting the Log4j vulnerability (CVE-2021-44228) for initial access. No law enforcement takedowns have been publicly reported, but several vendor reports from Qi-AnXin, Trend Micro, and the Recorded Future Insikt Group provide detailed technical breakdowns of the malware’s evolution across multiple satellite campaigns.

🔍 Detection Indicators

Known file hashes include MD5 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d (variant from 2020) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (unverified, found in public sandbox reports). Behavioral indicators include outbound HTTPS connections to domains matching patterns like *.bravonc[.]com or *.cdn-avast[.]net (legitimate CDN mimicry). Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRunBravoUpdate and mutex named “GlobalBravoNC_Mutex_01” are common detection points. Network traffic often contains a custom User-Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppVer/1.0.0 with a specific cookie “NCID=xxxxx”.

☠️ Risk & Impact

BravoNC enables full remote control of infected systems, leading to long-term data exfiltration of classified diplomatic communications, military plans, and intellectual property. Financial losses are indirect but significant, with affected sectors including government, defense, telecommunications, and energy—primarily in Southeast Asia. The malware has been linked to the theft of over 10 GB of sensitive documents from a single foreign ministry in 2021, according to Trend Micro’s threat report.

🛡️ Mitigation

Organizations should apply patches for critical vulnerabilities such as CVE-2020-0688 and CVE-2021-44228, enforce multi-factor authentication on remote access services, and deploy EDR solutions capable of detecting BravoNC’s service creation and HTTP beaconing patterns. Sigma rules for detecting the BravoNCsvc service name and the specific User-Agent string are available in the Detectree open-source repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.