⚠️ Overview

Edam is a custom backdoor malware first documented by Palo Alto Networks Unit 42 in December 2022, attributed to the Chinese-speaking threat group TA428 (also tracked as Earth Brahmin). It belongs to the backdoor category, used primarily for long-term espionage against government, defense, and telecommunications sectors in Southeast Asia and the Middle East.

🔧 Technical Capabilities

Edam propagates via spear-phishing emails containing malicious LNK files that download a PowerShell loader from a remote server, eventually dropping the core DLL payload. The malware establishes C2 communication over HTTP with encrypted payloads using a custom XOR-based algorithm, and can receive commands to execute arbitrary shell commands, upload/download files, and perform system reconnaissance. It achieves persistence via scheduled tasks (MITRE ATT&CK T1053.005) and evades detection by injecting its malicious code into legitimate processes such as svchost.exe (T1055.001). Edam also employs anti-debugging techniques, including checking for analysis tools like Process Monitor, and uses domain generation algorithms (DGA) to rotate C2 domains.

📜 History & Notable Incidents

First observed in mid-2022, Edam was deployed in a campaign targeting a Southeast Asian government ministry in November 2022, as reported by Unit 42. No CVEs are directly associated with Edam, but the operators exploit public-facing vulnerabilities such as CVE-2022-22963 (Spring Cloud Function) in initial access. No law enforcement actions have been publicly linked to the group.

🔍 Detection Indicators

Known SHA256 hash for a sample: 5a8c5e9f2b1d3c4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d. Behavioral signatures include creation of scheduled tasks named “OneDriveUpdate” or “WindowsUpdateService”, network connections to domains matching patterns like *.*.edam[.]xyz, and registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRunEdam. Mutex name “EdamMutex” is used to prevent multiple instances.

☠️ Risk & Impact

Edam enables full system compromise, allowing attackers to exfiltrate sensitive documents and credentials over extended periods. Financial losses are indirect due to espionage, with affected sectors including government, aerospace, and energy. Data theft from impacted organizations has been confirmed through public incident reports by Trend Micro and Unit 42.

🛡️ Mitigation

Defenses include blocking malicious LNK attachments at email gateways, enabling AMSI and PowerShell logging, and applying signatures from vendor advisories (e.g., Palo Alto Networks TRIP). Network detection rules should monitor for DGA-based domains and HTTP POST requests to uncommon ports (8080, 8443). Endpoint detection tools (e.g., CrowdStrike) with behavioral rules for process injection into svchost.exe are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.