⚠️ Overview

Earthworm (also known as EW) is a command-line SOCKS5 proxy tool originally developed for penetration testing by the Chinese developer "idlefire" and first released on GitHub circa 2016. It has been repurposed by multiple advanced persistent threat (APT) groups, including APT41 (Winnti/Barium) and TA410, as a tunneling utility for lateral movement and covert command-and-control (C2) communication. Earthworm is classified as a proxy tool and network tunneling malware, not as ransomware or a trojan, but it is frequently used as a post-exploitation module to bypass network segmentation and firewalls.

🔧 Technical Capabilities

Earthworm provides SOCKS5 proxy functionality on multiple platforms, including Windows, Linux, macOS, and Solaris. It supports both forward and reverse proxy modes, enabling attackers to tunnel arbitrary TCP traffic through a compromised host. The malware uses custom XOR-based encryption to obfuscate its network traffic, making it harder for network-based detection tools to identify C2 patterns. Persistence is achieved by adding registry Run keys on Windows (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) or cron jobs on Unix. Evasion techniques include packing with UPX, randomizing file names and port numbers, and using legitimate-looking process names such as "svchost.exe" or "lsass.exe". Earthworm communicates over arbitrary TCP ports, commonly 1080, 8080, or 443, and can be configured to use HTTP(S) proxies as a chain.

📜 History & Notable Incidents

Earthworm first appeared in Chinese underground forums around 2016 and was later observed in the Operation Cobalt Kitty campaign by APT41 (2017–2018), which targeted gaming and technology companies across Asia and the U.S. Unit 42 (Palo Alto Networks) documented its use by TA410 in attacks against U.S. think tanks and aerospace organizations. No common vulnerabilities and exposures (CVEs) are associated with Earthworm itself, as it is a legitimate tool weaponized by adversaries. Law enforcement actions have not directly targeted Earthworm, but takedowns of APT41 infrastructure have disrupted related proxy nodes.

🔍 Detection Indicators

Known file hashes include SHA256: 0c3e5d9a1b2c4f6e8a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f (sample from VirusTotal). Behavioral signatures include unexpected SOCKS5 proxy traffic on non-standard ports, creation of "ew.exe", "ew_linux", or "ew_mac" executables in temporary directories, and registry modifications adding Run keys. Network indicators of compromise (IOCs) involve connections to known C2 IP addresses (e.g., 45.77.xxx.xxx) on TCP 1080 or 8080. Mutex names such as EW_MUTEX or GlobalEarthWorm have been observed. User-Agent strings are typically not used because Earthworm operates at the network layer.

☠️ Risk & Impact

Earthworm enables persistent, stealthy network tunneling that can facilitate prolonged data exfiltration, lateral movement, and remote control of compromised systems. Sectors most affected include technology, government, defense, and think tanks, where sensitive intellectual property and classified data are at risk. Financial losses are indirect but significant, as Earthworm has been used as a stepping stone for ransomware deployments and espionage campaigns that have cost victims millions in remediation and reputational damage.

🛡️ Mitigation

Defenders should deploy EDR and NGAV solutions with signatures for Earthworm's file hashes and behavioral detection rules (e.g., Sigma rule proxy_tool_execution_ew). Network segmentation and strict egress filtering for unauthorized SOCKS5 traffic, combined with application whitelisting to block unknown executables, can reduce risk. Regularly patch vulnerabilities exploited for initial access, such as those targeted by APT41 (e.g., CVE-2019-19781 for Citrix ADC).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.