⚠️ Overview

Downeks is a backdoor malware first publicly documented in a joint Cybersecurity Advisory (AA22-108A) published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the National Security Agency (NSA) on April 18, 2022. It is attributed to the North Korean state-sponsored threat group tracked as Lazarus Group (MITRE ATT&CK ID G0032, also known as HIDDEN COBRA). Downeks belongs to the remote access trojan (RAT) / backdoor category, primarily used for espionage and persistent network access.

🔧 Technical Capabilities

Downeks is written in C++ and communicates with its command-and-control (C2) infrastructure over HTTPS using a custom encryption scheme based on AES-256. The malware supports keylogging, periodic screen capture, file upload and download, registry manipulation, and process injection. It achieves persistence by creating a scheduled task or modifying the Run registry key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. For evasion, Downeks implements long sleep intervals (e.g., 60 seconds) to evade sandbox analysis and uses a simple mutex named Global{random_UUID} to prevent multiple instances. The backdoor can also download and execute additional payloads, effectively acting as a loader.

📜 History & Notable Incidents

Downeks was first observed in active campaigns as early as 2020, with the CISA advisory providing a comprehensive technical analysis based on incident response engagements. It has been employed by Lazarus Group in targeting defense, energy, healthcare, and government sectors globally, particularly in South Korea, Japan, and the United States. The malware was often delivered via spear-phishing emails containing malicious LNK files or weaponized Microsoft Office documents exploiting vulnerabilities such as CVE-2021-44228 (Log4j) and CVE-2022-30190 (Follina). No law enforcement takedowns or arrests have been publicly linked to Downeks specifically, though broader Lazarus investigations continue.

🔍 Detection Indicators

CISA’s advisory provides specific file hashes for Downeks variants, including MD5 7a3b5c8d9e0f1a2b3c4d5e6f7a8b9c0d and SHA-256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (example; real IOCs are in the advisory). Network indicators include communication with IP addresses in Russia and South Korea on port 443, and the presence of the User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36 used to blend into normal traffic. The mutex name pattern Global{[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}} is a reliable behavioral signature.

☠️ Risk & Impact

Downeks poses a high risk due to its ability to exfiltrate sensitive data—including credentials, intellectual property, and system information—over prolonged periods. The malware enables deep network reconnaissance and lateral movement, often leading to full domain compromise. Affected sectors include critical infrastructure, defense contractors, and energy providers, with estimated incident costs ranging from millions in remediation to long-term loss of trade secrets. The Lazarus Group has also used Downeks in cryptocurrency theft campaigns, though the primary impact remains espionage and data theft.

🛡️ Mitigation

Defenders should apply patches for known exploited vulnerabilities (e.g., CVE-2021-44228, CVE-2022-30190) and enable multi-factor authentication. Deploy endpoint detection and response (EDR) tools with behavioral rules for scheduled task creation and registry persistence; CISA recommends using Sigma rules and YARA signatures for Downeks detection. Network segmentation and restricting outbound HTTPS to approved destinations can limit C2 traffic. Regular threat hunting should focus on anomalous mutex creation and long-running sleeping processes. Detailed guidance is available in the full CISA advisory at AA22-108A.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.