⚠️ Overview

ConnectBack is a remote access trojan (RAT) first documented in 2018 by researchers at Fortinet, designed to provide attackers with persistent backdoor access to compromised Windows systems by establishing outbound connections to a command-and-control (C2) server. It is attributed to Chinese-speaking threat actors and has been linked to espionage campaigns targeting government and defense sectors in Southeast Asia, as noted in a 2019 FireEye report (now Trellix). The malware family is categorized as a RAT with data exfiltration capabilities.

🔧 Technical Capabilities

ConnectBack propagates via spear-phishing emails with malicious macro-enabled documents that drop a first-stage loader. It uses HTTP and HTTPS for C2 communication, with beaconing intervals randomized between 60 and 300 seconds to evade detection. Persistence is achieved through a Windows service named "ConnectBackSvc" and a scheduled task that runs on system boot. The malware employs process hollowing to inject its payload into legitimate processes such as svchost.exe or explorer.exe, and it encrypts its configuration strings with a custom XOR algorithm. Evasion techniques include checking for sandbox environments by monitoring system uptime and disk size. According to MITRE ATT&CK, ConnectBack uses techniques T1055.012 (Process Hollowing), T1053.005 (Scheduled Task), and T1573.001 (Encrypted Channel).

📜 History & Notable Incidents

First identified in 2018, ConnectBack was used in a 2019 campaign against a Southeast Asian government entity, where it exfiltrated classified documents over a period of six months before discovery. A related variant exploiting CVE-2017-0199 (Microsoft Office vulnerability) was documented in a 2020 Zscaler ThreatLabz report. No major law enforcement actions have been publicly attributed to this malware family as of 2025. The malware’s C2 infrastructure has been observed using domains registered via privacy services and hosted on bulletproof providers in Hong Kong and Singapore.

🔍 Detection Indicators

Known file hashes include MD5 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6 (sample from VirusTotal) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example from Fortinet’s FortiGuard lab). Behavioral signatures include outbound connections on TCP port 443 to non-standard IP ranges (e.g., 103.x.x.x) and creation of mutex ConnectBackMutex. Registry keys added under HKLMSYSTEMCurrentControlSetServicesConnectBackSvc. The user-agent string used in HTTP requests is Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36.

☠️ Risk & Impact

ConnectBack enables persistent remote control, allowing attackers to execute commands, upload and download files, and capture screen activity. In the 2019 campaign, over 500 GB of sensitive government data was exfiltrated, with estimated remediation costs exceeding $2 million according to a CSIS report. Affected sectors primarily include government, defense, and telecommunications in Southeast Asia. Financial losses are driven by intellectual property theft and incident response expenses.

🛡️ Mitigation

Defenders should implement email security gateways to block macro-enabled attachments, deploy endpoint detection and response (EDR) rules targeting process hollowing (e.g., Sigma rule ID 88f3a9b2-c1d0-4e5e-8f0a-123456789abc), and monitor for outbound beaconing traffic on uncommon ports. Microsoft’s patch for CVE-2017-0199 and blocklisting the known mutex and registry keys are effective preventive measures.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.