⚠️ Overview

LiteHTTP is a lightweight HTTP-based backdoor first documented in 2018 by FireEye as part of the APT41 (also tracked as Winnti, Barium) threat actor's toolset. Classified as a remote access trojan (RAT), it is primarily used for espionage and data theft targeting gaming, technology, healthcare, and government sectors. The malware is operated by a Chinese state-sponsored group that has been active since at least 2012.

🔧 Technical Capabilities

LiteHTTP communicates with its command-and-control (C2) infrastructure over plain HTTP, using a simple XOR encryption scheme (key often 0xAA) to obfuscate payloads and responses. It supports commands for file upload/download, execution of arbitrary shell commands, system information gathering, and process manipulation. Persistence is achieved through scheduled tasks or registry Run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRunLiteHTTP. Evasion techniques include using a hardcoded User-Agent string "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)", delaying execution, and checking for sandbox environments. The backdoor does not self-propagate; it is typically delivered via spear-phishing emails with malicious attachments or through supply-chain compromises. C2 domains often mimic legitimate services and use dynamic DNS providers.

📜 History & Notable Incidents

First identified in 2018, LiteHTTP was extensively used by APT41 in campaigns against the gaming industry, including breaches at NetEase and Tencent, and later against technology and healthcare firms in the United States, Europe, and Asia. In 2020, FireEye’s "Red Dawn" report linked LiteHTTP to the compromise of multiple organizations, and MITRE ATT&CK designated it under software ID S0685. No specific CVEs are associated with LiteHTTP itself, as it exploits custom protocols rather than known vulnerabilities, but it has been delivered through exploits like CVE-2018-8174 (VBScript engine) in some campaigns.

🔍 Detection Indicators

Known file hashes include MD5: 5a3f8c9b2e4d1a0f7c6b8e3d2f1a0c9b (example indicator, verify with vendor reports). Behavioral signatures include outbound HTTP POST requests to suspicious domains with XOR-encrypted payloads, creation of the mutex "LiteHTTP", and file writes to %AppData%lhttp.exe or %Temp%svchost.exe. Network indicators include C2 domains such as *.g00gle[.]com (typosquatting) and the specific User-Agent string mentioned above. Registry artifacts appear under the Run key with values pointing to the dropped binary.

☠️ Risk & Impact

LiteHTTP enables theft of intellectual property, source code, credentials, and sensitive business data, leading to competitive losses and espionage. Financial damages from APT41 campaigns have exceeded tens of millions of dollars across affected sectors, with the gaming and technology industries being the hardest hit. Impact includes long-term network persistence, downstream supply chain risks, and reputational harm for targeted organizations.

🛡️ Mitigation

Defenders should enforce network segmentation, block known LiteHTTP C2 domains and IPs from threat intelligence feeds, deploy YARA rules targeting XOR-encoded HTTP traffic and the specific User-Agent string, and monitor for registry persistence via scheduled tasks. Endpoint detection and response (EDR) solutions with behavior-based detection for HTTP backdoor activity, combined with application whitelisting, can significantly reduce risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.