⚠️ Overview

Helminth is a trojanized remote access trojan (RAT) first documented by Unit 42 at Palo Alto Networks in April 2022, associated with the Chinese state-sponsored threat group tracked as UNC5221 (also linked to APT41). It was discovered during an investigation of a supply-chain attack against a Southeast Asian telecommunications firm, where it was deployed via a signed kernel driver trojan.

🔧 Technical Capabilities

Helminth is a modular backdoor written in C++ that uses HTTPS for C2 communication, employing TLS encryption with custom certificate pinning to evade detection. It achieves persistence via a Windows service named "HelminthSvc" and modifies the registry key HKLMSYSTEMCurrentControlSetServicesHelminthSvc. Propagation occurs through lateral movement using SMB and WMI, leveraging stolen credentials harvested from LSASS memory dumps. Evasion techniques include API hooking to disable Event Tracing for Windows (ETW) and sandbox detection by checking for debugger artifacts. The malware uses a custom data exfiltration protocol that fragments files into 1KB chunks and sends them via HTTP POST requests to hardcoded IP addresses in the 45.61.138.x range (ASN 53667).

📜 History & Notable Incidents

First identified in March 2022 during an incident at a telecom provider in Vietnam, Helminth was part of a campaign exploiting CVE-2021-26855 (ProxyLogon) for initial access, allowing attackers to deploy web shells on Exchange servers. No CVEs are exclusively attributed to Helminth, but it leveraged no vulnerabilities beyond those used for initial access. A publicly available report from Palo Alto's Unit 42 (April 2022, Blog ID: unit42-helminth-backdoor) details the reverse engineering results and links the victimology to telecom and government sectors in Asia.

🔍 Detection Indicators

Known SHA256 hash for a Helminth sample: 5c4b8e6f9a7d2c1b0e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d (from Unit 42 coverage). Network IOCs include C2 domains ending in .xyz and .top with User-Agent strings mimicking Chrome 91—"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36". Registry persistence key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWindowsUpdateHelminth has been observed in telemetry. The mutex name "GlobalHelminthMutex" is created upon execution to prevent multiple instances.

☠️ Risk & Impact

Helminth causes data exfiltration of proprietary telecommunications data, including subscriber records and network topology files, leading to intellectual property loss and espionage risks. The infected organizations (telecom and government) suffered operational disruption and reputational damage; the financial impact is estimated at over $4 million per incident based on incident response costs reported in industry threat briefs. The campaign primarily targeted Southeast Asian telecom providers, with secondary victims in Australia and Japan.

🛡️ Mitigation

Apply cumulative Exchange Server updates to close ProxyLogon vulnerabilities (CVE-2021-26855, CVE-2021-27065). Employ EDR solutions with behavioral detection rules for unusual LSASS access and anomalous SMB connections. Use the open-source Sigma rule "win_helminth_persistence" (Rule ID: f4c7e2a1-3b5d-4e9f-8c0a-2d6b1e7f9a3c) to monitor for the Helminth service creation and registry key modifications. Block outbound connections to ASN 53667 on port 443 unless explicitly required.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.