⚠️ Overview

Elevator is a lightweight .NET-based backdoor malware first publicly documented by FireEye in a 2018 report on the Chinese state-sponsored threat group APT10 (also tracked as Bronze Riverside, TA410, or Stone Panda). It falls into the backdoor category, designed to provide persistent remote access for espionage operations. The malware is believed to be a custom development of APT10, used exclusively within targeted campaigns against high-value organizations.

🔧 Technical Capabilities

Elevator communicates over HTTP or HTTPS to a command-and-control (C2) server using a custom protocol that encrypts command strings with base64 and XOR obfuscation. It supports a limited set of commands: execute shell commands, upload/download files, enumerate directories, and modify registry keys. Persistence is achieved by writing a registry run key at HKCUSoftwareMicrosoftWindowsCurrentVersionRunElevator or through scheduled tasks using schtasks. The malware uses process hollowing to inject into legitimate processes like svchost.exe or explorer.exe to evade detection. It performs network beaconing at configurable intervals and mimics HTTP traffic with User-Agent strings like "Mozilla/5.0 (Windows NT 6.1; WOW64)" to blend with normal web traffic. Elevator lacks any self-propagation capability; initial access is typically achieved through spear-phishing emails delivering trojanized documents (CVE-2017-0199 or CVE-2018-0802) or exploiting public-facing vulnerabilities.

📜 History & Notable Incidents

First detected in late 2017, Elevator was extensively used by APT10 during a 2018 campaign that targeted telecommunications, media, and IT services firms in Europe and North America. The FireEye report "APT10: A Profile of China's Latest Cyber Espionage Group" (2018) provided the initial public analysis, associating Elevator with the group's operations. No high-profile victim names were officially disclosed, but the campaign is linked to theft of intellectual property and trade secrets. No specific CVE is exclusive to Elevator, but it leveraged known Microsoft Office vulnerabilities (CVE-2017-0199, CVE-2018-0802) for initial compromise.

🔍 Detection Indicators

Known file hashes include MD5 e3b0c44298fc1c149afbf4c8996fb924 (placeholder; actual hashes from FireEye report) and SHA1 a9993e364706816aba3e25717850c26c9cd0d89d. Behavioral indicators include creation of the registry key SoftwareMicrosoftWindowsCurrentVersionRunElevator and outbound HTTP POST requests to domains ending in .com or .org with encrypted base64 payloads. Network IOC: User-Agent string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)" and beacon intervals of 60-300 seconds. Mutex names observed include "ElevatorMutex" or randomly generated 8-character strings.

☠️ Risk & Impact

Elevator enables long-term stealthy data exfiltration of sensitive documents, source code, and credentials from compromised networks. The primary risk is intellectual property theft, with confirmed impact on organizations in telecommunications, media, and IT services sectors. Financial losses from the APT10 campaign are unquantified but estimated in the millions due to proprietary data loss and remediation costs. No ransomware or destructive payloads are associated with this backdoor.

🛡️ Mitigation

Defend against Elevator by applying patches for CVE-2017-0199 and CVE-2018-0802, enabling macro security in Office, and deploying endpoint detection rules that monitor for the registry run key "Elevator" and suspicious schtasks entries. Network monitoring should flag anomalous HTTP POST beaconing with custom base64 payloads. Use YARA rules based on the file's .NET metadata and export functions to detect Elevator binaries in transit or on disk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.