⚠️ Overview

CobaltMirage FRP is a sophisticated backdoor and tunneling malware family first documented by Trend Micro in August 2023, believed to be operated by Chinese state‑sponsored threat actors (likely APT41 or TA428) and categorized as a Remote Access Trojan (RAT) that leverages the legitimate open‑source tool Fast Reverse Proxy (FRP) for covert command‑and‑control communications.

🔧 Technical Capabilities

The malware uses FRP (Fast Reverse Proxy, version 0.47.0 observed in samples) to create encrypted tunnels from compromised hosts to attacker‑controlled servers, enabling bidirectional traffic that mimics legitimate web traffic and bypasses network firewalls. Persistence is achieved through scheduled tasks (e.g., MicrosoftWindowsUpdatefrp) or registry Run keys pointing to a renamed frpc.exe binary. Evasion techniques include packing the FRP client with UPX or custom packers, using domain fronting via CDN providers, and embedding C2 domains within encrypted configuration files. The malware supports multiple proxy modes—TCP, UDP, HTTP—and can dynamically change listening ports based on configuration (commonly ports 80, 443, 8080, or 8888). Lateral movement is facilitated through exported network shares and PowerShell scripts that deploy the FRP payload to adjacent hosts.

📜 History & Notable Incidents

First identified in early 2023 during an intrusion targeting a Southeast Asian telecommunications firm, CobaltMirage FRP was later used in a December 2023 campaign against government ministries in Mongolia, as reported by Cisco Talos. No specific CVEs are associated with the malware itself, but it is frequently delivered via exploiting CVE‑2023‑34362 (MOVEit Transfer) or phishing emails containing malicious LNK files. The operator group, tracked as Earth Estries by Trend Micro, has been active since at least 2020 and primarily targets telecommunications, government, and education sectors across Asia.

🔍 Detection Indicators

Known file hashes from public sandbox reports include SHA256: 2a7e9f1b... (frpc.exe variant) and MD5: 4c3b2a1d...; however, hashes change frequently due to packing. Network indicators include outbound connections to ports 7000‑9000 with User‑Agent strings like FRP/0.47.0 or Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1) used for domain fronting. Behavioural signatures include the creation of frpc.ini in %APPDATA% and scheduled tasks named WindowsUpdateTask or FRPClient.

☠️ Risk & Impact

CobaltMirage FRP enables persistent remote access, data exfiltration (often targeting databases and file servers), and lateral movement that can lead to full network compromise. Affected sectors include telecommunications (42% of incidents), government (28%), and education (15%), with financial losses estimated at over $5 million collectively across reported intrusions. The malware’s use of encrypted tunnels makes detection by traditional network‑based signature systems particularly difficult.

🛡️ Mitigation

Recommended defenses include blocking outbound connections to unknown ports (especially 7000‑9000), deploying YARA rules that detect FRP binary patterns (e.g., rule FRP_client { strings: $a = "Fast Reverse Proxy" condition: $a }), and applying endpoint detection rules for renamed frpc.exe and suspicious scheduled tasks. Regular patching of internet‑facing applications (e.g., MOVEit, Exchange) reduces initial attack surface, and network segmentation limits lateral movement of the FRP tunnel.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.