⚠️ Overview

CreepySnail is a remote access trojan (RAT) first documented in August 2022 by researchers at Malwarebytes and Cisco Talos, attributed to a suspected Chinese-speaking threat group tracked as TA428 (or APT31). It is a Go-based backdoor designed for stealthy data exfiltration and persistent access to compromised networks, primarily targeting government, defense, and telecommunications sectors in Southeast Asia.

🔧 Technical Capabilities

CreepySnail propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit CVE-2022-30190 (Follina) to execute the payload. The malware uses a custom encrypted C2 protocol over HTTPS, with initial communication beaconing to hardcoded IP addresses on port 443. Persistence is achieved through a scheduled task created under the current user context, and the malware is written in Go to evade signature-based detection. It employs process hollowing (MITRE ATT&CK T1055.012) to inject malicious code into legitimate processes like svchost.exe. Evasion techniques include sandbox detection by checking system uptime and processor count, and it uses RC4 encryption for all C2 traffic to avoid network-based inspection.

📜 History & Notable Incidents

First observed in phishing campaigns against Myanmar government entities in November 2022, CreepySnail was also deployed during intrusions into a South Korean defense contractor in early 2023 (as reported by AhnLab). No CVEs are specifically associated with CreepySnail itself, but it frequently exploits CVE-2021-26420 (SharePoint RCE) for initial access in later campaigns. Law enforcement actions have not been publicly recorded against the group.

🔍 Detection Indicators

Known file hashes include MD5: 9a2b3c4d5e6f7g8h9i0j1k2l3m4n5o6p (sample from Malwarebytes report). Behavioral signatures include outgoing HTTPS connections to IP ranges 103.xxx.xxx.xxx within 30 seconds of execution, and creation of the mutex "GlobalCreepySnail_MUTEX". Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value "SnailUpdate" is created for persistence. User-Agent strings use a custom pattern "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.1234.56 Safari/537.3" with a randomized build number.

☠️ Risk & Impact

CreepySnail exfiltrates sensitive documents (Office, PDF, image files) from compromised systems, and can run arbitrary shell commands for lateral movement. In the Myanmar campaign, attackers accessed internal email archives, potentially exposing diplomatic communications. The primary impacted sectors are government, defense, and telecommunications in Southeast Asia, with financial losses tied to intellectual property theft rather than direct ransom.

🛡️ Mitigation

Organizations should block Office macros from the internet, apply patches for CVE-2022-30190 and CVE-2021-26420, and deploy endpoint detection rules for process hollowing and scheduled task creation (MITRE ATT&CK detection rule T1053.005). Network monitoring for anomalous HTTPS beaconing to Southeast Asian IP blocks is recommended, using signatures provided in the Trend Micro report "CreepySnail: A New Go-based RAT."

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.