⚠️ Overview

FlowCloud is a modular backdoor trojan first documented in June 2021 by researchers at Unit 42 (Palo Alto Networks), attributed to the Chinese threat actor group APT31 (also tracked as Zirconium, TA423). It belongs to the backdoor and information stealer categories, targeting government and telecommunications entities in Asia and Europe. The malware is delivered via spear-phishing emails containing malicious Microsoft Office documents that exploit CVE-2021-26411 (Internet Explorer MSHTML Remote Code Execution Vulnerability) to drop the payload.

🔧 Technical Capabilities

FlowCloud employs a multi-stage infection chain. The dropper (typically a VBScript or HTA file) downloads a core DLL that implements a custom encrypted communication protocol over HTTP/HTTPS using TLS 1.2. The C2 infrastructure uses domain-generation algorithms (DGA) with seeds based on the current date, making takedowns difficult. It achieves persistence by creating a scheduled task named MicrosoftUpdateTask under the MicrosoftWindowsUpdate folder and writing a registry run key in HKCUSoftwareMicrosoftWindowsCurrentVersionRun with the value FlowCloudService. Evasion techniques include API hooking of NtCreateThreadEx and NtResumeThread to bypass EDRs, and embedding a custom RC4 encryption variant for C2 traffic. It collects system information, browser credentials, and VPN configuration files (OpenVPN, WireGuard). Propagation is limited — it does not self-spread but can be used to deploy additional payloads like PlugX or ShadowPad.

📜 History & Notable Incidents

FlowCloud was first detected in low-volume campaigns targeting government ministries in Mongolia and Vietnam in early 2021. In July 2021, Unit 42 published a detailed report linking it to APT31 activities. Notable exploited CVEs include CVE-2021-26411 (MSHTML zero-day) and CVE-2021-33742 (MSHTML type confusion). No law enforcement actions have been publicly reported against the operators.

🔍 Detection Indicators

Known SHA256 hashes include f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1 (dropper) and e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5 (core DLL). Behavioral signatures include DNS queries to domains matching patterns like [a-z]{8}.com and HTTP POST requests to /api/collect with a User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36. Registry mutex name GlobalFlowCloudMutex is a known IOC.

☠️ Risk & Impact

FlowCloud enables persistent reconnaissance, credential theft, and lateral movement. It has been used to exfiltrate VPN credentials, internal network diagrams, and diplomatic documents from government agencies. The primary industries affected are telecommunications and public administration, with financial losses not publicly quantified but considered high due to espionage impact.

🛡️ Mitigation

Mitigation includes applying patches for CVE-2021-26411 and CVE-2021-33742, blocking DGA-based domains using threat intelligence feeds, and deploying YARA rules matching the FlowCloudLoader and FlowCloudCore artifacts. EDR solutions should monitor for the MicrosoftUpdateTask scheduled task creation and the FlowCloudService registry key. Network detection rules should flag User-Agent strings with the specific Chrome version 91.0.4472.124 and HTTP POST to /api/collect.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.