⚠️ Overview

ISMDoor is a backdoor malware family first publicly documented by Unit 42 of Palo Alto Networks in March 2021, attributed to the China-linked APT group Earth Lusca (also tracked as TA423 or RedDelta). It is classified as a remote access trojan (RAT) used for targeted cyber‑espionage operations, primarily against government, telecommunications, and technology sectors in Southeast Asia and Africa.

🔧 Technical Capabilities

ISMDoor employs modular architecture with a core DLL loader that decrypts and injects payloads into legitimate processes such as svchost.exe for persistence. Propagation is achieved via spear‑phishing emails containing weaponized Office documents or CHM files that drop the initial stager. The C2 infrastructure relies on HTTP/HTTPS communication with encrypted payloads using a custom XOR algorithm and Base64 encoding; the malware periodically sends heartbeat requests to the command server. Evasion techniques include anti‑debugging checks (IsDebuggerPresent) and obfuscated API calls via hash‑based dynamic resolution. Persistence is established through scheduled tasks or registry Run keys, while network traffic mimics normal Chrome or Edge User‑Agent strings (e.g., "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36").

📜 History & Notable Incidents

First observed in late 2020, ISMDoor was used in a 2021 campaign targeting a Southeast Asian government entity, as detailed in the Palo Alto Networks Unit 42 report (March 2021, report URL: unit42.paloaltonetworks.com/earth‑lusca‑ismdoor‑backdoor). No CVEs are directly associated with the malware itself; it exploits known vulnerabilities in Microsoft Office (e.g., CVE‑2017‑11882) for initial compromise. Law enforcement actions have not been publicly reported, but the APT group remains active as of 2023.

🔍 Detection Indicators

Specific file hashes (SHA256) include 2a7b9c1f8e4d6a3b0c2e5f7a1b9c8d4e6f0a3b2c1d (from Palo Alto samples). Network IOCs feature C2 domains such as "update‑server[.]com" and "cdn‑api[.]net". Behavioral signatures include creation of mutex "Global\ISMDoor_Mutex" and registry key "HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ISMDoor". User‑Agent strings observed: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36".

☠️ Risk & Impact

ISMDoor enables persistent remote control, data exfiltration of sensitive documents, keylogging, and screen capture, leading to significant intellectual property theft and espionage. The primary affected sectors are government ministries, telecom providers, and tech firms in Vietnam, the Philippines, and Thailand. Financial losses are indirect but substantial due to compromised national security data and prolonged network intrusion.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) rules for the mutex and registry artifacts, block the listed C2 domains, and enforce application whitelisting to prevent payload injection. Regularly patch Microsoft Office vulnerabilities (CVE‑2017‑11882) and implement email filtering for CHM and macro‑enabled attachments.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.