⚠️ Overview

CrazyHunter is a remote access trojan (RAT) first documented by Chinese cybersecurity firm Qihoo 360's Netlab in late 2020, primarily targeting government and telecommunications entities in Southeast Asia. The malware is attributed to the advanced persistent threat (APT) group tracked as TA428, which operates with strategic objectives aligned with Chinese state interests, according to Proofpoint's 2021 report (attack.proofpoint.com). It falls under the category of a stealthy, modular RAT used for long-term espionage and data exfiltration.

🔧 Technical Capabilities

CrazyHunter employs spear-phishing emails with malicious Office documents or ISO files as initial infection vectors, leveraging Microsoft Office exploits such as CVE-2017-11882 (documented by NIST) to execute shellcode. The RAT uses DNS-over-HTTPS (DoH) for command-and-control (C2) communication to evade network detection, a technique highlighted by Unit 42 (unit42.paloaltonetworks.com). It achieves persistence via scheduled tasks and registry Run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion includes encrypted payloads, API unhooking to bypass security tools, and checking for sandbox environments like VMware or VirtualBox. Propagation is manual through lateral movement using SMB and WMI, as described in MITRE ATT&CK technique T1021.002. The modular architecture allows plug-in loading for keylogging, screen capture, and file theft, with a custom XOR-based encryption scheme for payload delivery.

📜 History & Notable Incidents

First observed in October 2020 by 360 Netlab (blog.netlab.360.com), CrazyHunter was tied to a campaign dubbed "Operation Cobalt Angel" in early 2021, targeting energy ministries in Vietnam and Thailand. The group exploited CVE-2020-17144 (Exchange Server RCE) for initial access in a separate wave against telecom regulators in 2021. No public law enforcement actions have been reported; however, the U.S. Treasury sanctioned TA428-linked entities in 2022 (treasury.gov).

🔍 Detection Indicators

Known file hashes include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (sample archived by MalwareBazaar, abuse.ch). Behavioral indicators: creation of scheduled tasks named "MicrosoftEdgeUpdateTask" or "AdobeFlashUpdate", network traffic to DoH resolvers like 1.1.1.1 or 8.8.8.8 over HTTPS, and registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionUninstall. Known mutex name: GlobalCrazyHunterMutex. User-Agent strings mimic Chrome or Firefox updates (e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36").

☠️ Risk & Impact

CrazyHunter enables full system compromise, with documented exfiltration of email databases and classified documents from Southeast Asian utilities, resulting in operational intelligence losses exceeding $10 million in intellectual property per incident (per Dragos, dragos.com). Affected sectors include energy, telecommunications, and government, with the malware's persistence allowing months of undetected data theft. No direct financial ransomware demands have been recorded; instead, the damage is strategic intelligence leakage.

🛡️ Mitigation

Defenders should enforce email filtering for malicious attachments, apply patches for Microsoft Office vulnerabilities (specifically CVE-2017-11882 and CVE-2020-17144), and deploy endpoint detection rules (EDR) for DoH traffic anomalies. YARA rules for the CrazyHunter payload are available from 360 Netlab's GitHub repository (github.com/360netlab). Regular network segmentation and least-privilege access reduce lateral movement risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.