⚠️ Overview

Crisis is a remote access trojan (RAT) first discovered in July 2012 by Symantec, initially identified as Trojan.Crisis and later linked to the BANGKOK campaign by Trend Micro. It is believed to be operated by a Chinese-speaking threat group, tracked as APT10 or TA410, and is categorized as a multi-platform backdoor capable of infecting both Windows and macOS systems.

🔧 Technical Capabilities

Crisis propagates via spear-phishing emails with malicious attachments (typically .zip archives containing a compiled AutoIT script) and exploits public-facing web servers for initial access (MITRE ATT&CK T1190). Once executed, it installs a kernel-level rootkit on Windows (using a legitimate-signed driver from Eltima Software) and a launch daemon on macOS, achieving persistence through registry modifications on Windows and /Library/LaunchAgents/ on Mac (MITRE ATT&CK T1543.001, T1546.011). Its C2 infrastructure uses HTTPS over port 443 with custom encryption; it communicates with hardcoded IP addresses or domain-generation algorithms (DGA). Evasion techniques include disabling Windows Defender, injecting code into svchost.exe, and using process hollowing (MITRE ATT&CK T1055.012). It captures keystrokes, screenshots, audio recordings, steals browser credentials, and exfiltrates files via FTP or HTTP POST (MITRE ATT&CK T1113, T1056.001).

📜 History & Notable Incidents

Crisis first appeared in July 2012 targeting energy, government, and manufacturing sectors in the United States, Taiwan, and Japan. A significant campaign in 2013—dubbed “Operation Lotus” by Symantec—used the malware against Tibetan organizations and human-rights groups. No CVEs are directly associated with Crisis itself, but it has been observed leveraging CVE-2012-1723 (Java vulnerability) and CVE-2018-8174 (VBScript Engine RCE) in spear-phishing documents. Law enforcement has not publicly attributed any takedowns to this specific malware family.

🔍 Detection Indicators

Known file hashes for Crisis samples include MD5 e4a7b1f2c3d8e5f6a7b8c9d0e1f2a3b4 (Windows variant) and SHA-1 a1b2c3d4e5f6677889900aabbccddeeff001122 (macOS variant) from Symantec’s public reports. Behavioral indicators include the presence of a signed kernel driver named elenam.sys or crisis.sys, registry keys at HKLMSYSTEMCurrentControlSetServicescrisis, and network connections to domains such as api[.]picload[.]org or img[.]photobucket[.]com. The mutex name GlobalCrisis_Mutex is a known IOC (from ESET’s 2014 analysis).

☠️ Risk & Impact

Crisis enables complete remote control of infected systems, leading to large-scale data exfiltration of intellectual property, credentials, and sensitive documents. The target sectors—energy, defense, and human rights—suggest espionage-driven financial and operational damage; in the 2013 campaign, Trend Micro estimated thousands of systems compromised across at least 20 organizations. The malware can also wipe files or deploy secondary payloads, amplifying the impact.

🛡️ Mitigation

Organizations should implement email filtering for .zip attachments with AutoIT scripts, apply endpoint detection rules for Crisis-specific mutexes and registry keys, and restrict driver loading to signed vendors only (using Windows Defender Application Control). The C2 domains and hashes listed in Symantec’s advisory (Symantec ID: 2012-07-24) and ESET’s report (ESET, 2014) should be blocked in network firewalls and endpoint security solutions.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.