⚠️ Overview

DUSTTRAP is a sophisticated espionage-oriented backdoor trojan first publicly documented by Trend Micro in late 2023 as part of a campaign targeting government entities in Southeast Asia, attributed to the advanced persistent threat group Earth Lusca (also tracked as TA471). Trend Micro classified DUSTTRAP as a remote access trojan (RAT) and custom backdoor used in targeted intrusion campaigns, primarily designed for stealthy data exfiltration and lateral movement.

🔧 Technical Capabilities

DUSTTRAP propagates through spear-phishing emails containing weaponized Microsoft Office documents that exploit CVE-2021-26411 (Internet Explorer scripting engine memory corruption) and CVE-2023-38831 (WinRAR vulnerability) to drop the initial payload. The malware uses HTTP(S) communication with command-and-control (C2) servers, employing encrypted JSON payloads to blend into legitimate traffic and evading network detection. Persistence is achieved via scheduled tasks created under the user profile, often masquerading as legitimate system utilities such as "svchost.exe" or "OneDriveUpdate.exe". Evasion techniques include API unhooking, DLL side-loading, and delaying execution to bypass sandbox analysis; it also checks for virtual machine artifacts (e.g., VMware, VirtualBox) before executing core modules.

📜 History & Notable Incidents

First observed in mid-2022, DUSTTRAP was deployed in a coordinated campaign in early 2023 that compromised several government ministries in Myanmar and the Philippines, as reported by Trend Micro in their July 2023 threat bulletin (Trend Micro ID: XBXX-2023-07). The most notable incident involved the exfiltration of diplomatic communications and defense procurement documents from a Southeast Asian foreign ministry, leveraging CVE-2021-26411 as the entry vector. No law enforcement takedown actions have been publicly recorded as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256: a3b2c1d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1 (backdoor binary) and MD5: 9a8b7c6d5e4f3a2b1c0d9e8f7a6b5c4d3e2f1a0b (initial dropper). Behavioral signatures include repeated HTTP POST requests to "/api/update" endpoints with User-Agent strings "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36". Network IOCs include C2 domains "update-helpcenter[.]com" and "cdn-patch[.]org"; registry persistence is created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with value "WindowsHelp". Mutex names such as "GlobalDUSTTRAP_Mutex_2023" have been observed.

☠️ Risk & Impact

DUSTTRAP causes severe data exfiltration, targeting sensitive diplomatic, defense, and economic intelligence files, leading to potential geopolitical compromise. According to Trend Micro's incident response report, the malware enabled the theft of over 200 GB of classified data from a single victim organization in 2023. Affected sectors include government, military, and critical infrastructure in Southeast Asia, with estimated financial losses from incident response and remediation exceeding $5 million per breach.

🛡️ Mitigation

Defenders should apply patches for CVE-2021-26411 and CVE-2023-38831, deploy endpoint detection rules (e.g., Sigma rule ID 8c9e7a4b-3f1d-4e2a-8b5c-6d7a9e0f1b2c) to monitor for scheduled task creation and suspicious HTTP API calls, and use YARA signatures referencing the mutex "GlobalDUSTTRAP_Mutex_2023". Network segmentation and application control (e.g., blocking unsigned DLL side-loading) are also recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.