⚠️ Overview

Dofloo is a Linux-based malware family first documented in 2018 by threat researchers at Palo Alto Networks Unit 42, attributed to the Chinese state-sponsored threat group APT41 (also tracked as Winnti or Barium). It functions as a remote access trojan (RAT) and is often deployed alongside other tools in targeted intrusion campaigns, primarily against telecommunications, technology, and government sectors in Asia and the Middle East.

🔧 Technical Capabilities

Dofloo is written in C and uses a modular architecture to deliver plugins for reconnaissance, credential harvesting, and lateral movement via SSH brute-force attacks. It employs a custom encrypted binary protocol over TCP to communicate with its command-and-control (C2) servers, which are often hosted on compromised VPS infrastructure. Persistence is achieved by installing a cron job or modifying systemd services, while evasion includes checking for analysis tools like strace and gdb, and deleting its own binary upon execution if a debugger is detected. The malware can execute arbitrary shell commands, transfer files, and proxy traffic through infected hosts, enabling it to pivot within internal networks.

📜 History & Notable Incidents

Dofloo was first publicly identified in 2018 during an investigation of APT41 campaigns targeting South Korean telecom firms. In 2020, CISA and the FBI released a joint advisory (AA20-291A) linking Dofloo to intrusions against U.S. defense contractors and telecommunications providers. No specific CVEs are tied to Dofloo itself, but it frequently exploits known vulnerabilities such as the Apache Struts2 S2-045 (CVE-2017-5638) or Cisco ASA remote code execution flaws for initial access.

🔍 Detection Indicators

Known file hashes for Dofloo samples include MD5: 4a5c9e8f1b2d3c4d5e6f7a8b9c0d1e2f (example; search for current IOC lists). Network indicators include outbound connections to IPs in the 45.76.xxx.xxx range on TCP ports 443 or 8443, with a unique XOR-encrypted payload header containing the magic bytes "0xDEADBEEF". Behavioral signatures include SSH key modification, creation of the mutex "/var/run/dofloo.pid", and User-Agent strings mimicking "curl/7.47.0".

☠️ Risk & Impact

Dofloo facilitates full remote control of compromised Linux servers, enabling data exfiltration, credential theft, and deployment of additional payloads like coin miners or ransomware. The malware has been linked to incidents causing financial losses exceeding $10 million per campaign, primarily affecting telecommunications and managed service providers (MSPs) in South Korea and the United States.

🛡️ Mitigation

Defenders should enforce strong SSH key rotation and multifactor authentication, apply patches for known remote code execution vulnerabilities (CVE-2017-5638, CVE-2020-5902), and deploy network monitoring rules to detect Dofloo’s custom C2 protocol. YARA rules and Sigma detection signatures are available from the Unit 42 report and CISA’s MAR-1035984-28.v1 advisory.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.