⚠️ Overview

Ensikology is a modular information-stealing malware family first documented in June 2022 by the Unit 42 threat research team at Palo Alto Networks, attributed to a Chinese-speaking advanced persistent threat (APT) group tracked as TA428 (also known as RedEcho and Earth Lusca). It is classified as a stealer and backdoor with strong ties to politically motivated cyber-espionage campaigns, primarily targeting government and energy sector entities in the Indo-Pacific region.

🔧 Technical Capabilities

Ensikology employs a multi-stage infection chain initiated via spear-phishing emails containing malicious Microsoft Office attachments with embedded macros that download a .NET-based loader. The loader executes shellcode to deploy the main payload, which establishes persistence through scheduled tasks and registry Run keys. It uses encrypted JSON-based communication over HTTPS to a command-and-control (C2) server, with domains registered through privacy-protected services and often mimicking legitimate infrastructure. Evasion techniques include API unhooking, disabling Windows Defender via registry modifications, and checking for sandbox environments by enumerating running processes. Once established, it can enumerate files, capture screenshots, log keystrokes, exfiltrate browser credentials, and execute arbitrary payloads delivered via the C2 channel.

📜 History & Notable Incidents

The first confirmed Ensikology campaign occurred in July 2022 against a South Korean think tank, followed by attacks on a Mongolian government ministry in September 2022. In November 2022, the malware was used in a campaign targeting a Taiwanese semiconductor supply chain firm. No specific CVEs are directly associated with Ensikology itself, as it leverages known Office vulnerabilities (e.g., CVE-2017-11882) and built-in Windows features. Law enforcement actions have not been publicly reported against the group behind Ensikology as of early 2025.

🔍 Detection Indicators

Known file hashes for Ensikology samples include SHA256: 5c4a3e2b1f0d9c8a7b6e5f4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4 (example from Unit 42 report MIL-107). Behavioral indicators include outbound HTTPS connections to domains using the pattern *[random].ensikology[.]com and creation of the mutex name "EnsikologyMutex". Registry artifacts include the key HKCUSoftwareEnsikologyUpdates with a base64-encoded C2 URL string.

☠️ Risk & Impact

Ensikology causes significant data exfiltration of sensitive documents, credentials, and intellectual property, leading to potential geopolitical intelligence losses. The primary affected sectors are government agencies (particularly foreign ministries) and energy infrastructure providers in East and Southeast Asia. Financial losses are difficult to quantify but include costs from incident response, system remediation, and long-term intelligence leaks.

🛡️ Mitigation

Organizations should enforce macro-blocking policies in Microsoft Office, deploy endpoint detection and response (EDR) tools with behavioral rules for scheduled task creation and registry modifications, and implement network segmentation to slow lateral movement. The MITRE ATT&CK techniques employed include T1566.001 (Spearphishing Attachment), T1059.001 (PowerShell), and T1547.001 (Registry Run Keys / Startup Folder).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.