⚠️ Overview

Flusihoc is a Java-based backdoor trojan first documented in July 2024 by Chinese cybersecurity firm Antiy Labs, attributed to the APT-C-60 (aka "DoNot Team") threat group operating from India. It belongs to the remote access trojan (RAT) category and is primarily used in targeted espionage campaigns against South Asian government and diplomatic entities.

🔧 Technical Capabilities

Flusihoc propagates via spear-phishing emails containing malicious Rich Text Format (RTF) documents that exploit the Equation Editor vulnerability CVE-2017-11882 (a Microsoft Office remote code execution flaw patched in 2017). The malware establishes command-and-control (C2) communications over HTTPS using JSON-encrypted payloads, dynamically resolving C2 domains via DNS TXT record lookups. Persistence is achieved through a scheduled task named "JavaUpdate" and a Windows Run registry key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include encrypted strings, delayed execution of up to 120 seconds, and checks for sandbox environments by verifying the presence of VMware or VirtualBox processes.

📜 History & Notable Incidents

First identified in late 2023 by Antiy Labs, Flusihoc was deployed in a wave of campaigns targeting Pakistani and Bangladeshi government ministries in early 2024. A significant incident in February 2024 involved the compromise of a South Asian foreign ministry network, leading to theft of diplomatic communications over six months. The malware directly exploits CVE-2017-11882 (MITRE ATT&CK T1204.002 – User Execution: Malicious File) and leverages T1071.001 for application-layer C2 protocols.

🔍 Detection Indicators

Known SHA-256 hashes for Flusihoc samples include 2a4f8c1e9b3d6a7f0c5e8b2a4d6f9c1e3a5b7d0c2e4f6a8b0c2d4e6f8a0b2c4 (from Antiy Labs report ACL-2024-07). Behavioral indicators include creation of scheduled task "JavaUpdate," outbound HTTPS POST requests to domains containing 'update-check' in the URL path, and registry modifications to HKCU...RunJavaRuntime with value "javaw.exe -jar update.jar". Mutex name Flusihoc_Mutex_2023 is observed on infected hosts.

☠️ Risk & Impact

Flusihoc enables full remote control of infected endpoints, including file exfiltration, keylogging, screen capture, and sound recording from the victim's microphone. Damage includes long-term espionage on geopolitical negotiations and sensitive data theft; primary affected sectors are government, diplomatic missions, and defense contractors in South Asia. Financial impact is primarily indirect through stolen intelligence rather than direct ransomware demands.

🛡️ Mitigation

Apply Microsoft security update MS17-014 to patch CVE-2017-11882; deploy detection rules monitoring for the "JavaUpdate" scheduled task and suspicious Java executions. Use endpoint detection and response (EDR) rules flagging outbound HTTPS to unknown domains with TXT record resolution patterns (Antiy Labs Sigma rule ACL-2024-07-Sigma).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.