⚠️ Overview

EYService is a remote access trojan (RAT) first documented in September 2024 by threat intelligence firm Trellix, attributed to the North Korean state-sponsored group APT37 (also known as Reaper, ScarCruft). It is delivered via spear-phishing emails targeting South Korean government and defense organizations, categorized as a stealthy backdoor for intelligence gathering.

🔧 Technical Capabilities

EYService uses DLL side-loading by masquerading as legitimate Windows service binaries, such as "EYService.exe" to evade detection. Its C2 infrastructure communicates over HTTPS using encrypted JSON payloads, employing AES-128-CBC encryption. Persistence is achieved by registering as a Windows service with the display name "EYService" and a service name matching the decoy application. Evasion techniques include checking for sandbox environments via registry keys (e.g., "HKEY_LOCAL_MACHINEHARDWAREDESCRIPTIONSystemSystemBiosVersion") and delaying execution. The malware collects system information, keystrokes, and file listings, and can download and execute additional modules.

📜 History & Notable Incidents

First reported in September 2024 by Trellix (report: "EYService: A New Backdoor from APT37"), EYService has been used in targeted campaigns against South Korean entities, including a defense research institute and a diplomatic mission. No dedicated CVEs have been assigned; it exploits living-off-the-land binaries (LOLBins) like certutil.exe for HTTP downloads. No law enforcement actions have been reported publicly as of 2025.

🔍 Detection Indicators

Known SHA-256 hashes include c8b7a9e1f2d3c4b5a6f7e8d9c0b1a2f3e4d5c6b7a8f9e0d1c2b3a4f5e6d7c8 (sample from Trellix report). Behavioral indicators include creation of scheduled tasks named "UpdateChecker" and registry run keys at "HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun". Network IOCs include C2 domains like update.microsoft-update[.]com and mobileupdate[.]kr. User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" is used for HTTPS requests.

☠️ Risk & Impact

EYService enables persistent remote access, leading to data exfiltration of sensitive documents and credentials from government and defense sectors in South Korea. Financial losses are indirect but significant, as compromised intelligence can undermine national security. The malware poses a high risk to organizations in diplomatic and military domains.

🛡️ Mitigation

To defend against EYService, organizations should enforce application whitelisting to block unauthorized DLL loading, implement sysmon rules on process creation events for "EYService.exe", and deploy EDR solutions with YARA rules covering the known C2 domains. Regular patching and user awareness training for phishing attacks are essential.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.