⚠️ Overview

LittleDaemon is a modular remote access trojan (RAT) and data stealer first documented in June 2024 by researchers at Cyble, who attributed its development to a threat actor tracked as TA883 based on infrastructure overlaps and code similarities. The malware is designed primarily for espionage and credential theft, targeting Windows systems across government, education, and healthcare sectors in the Asia-Pacific region.

🔧 Technical Capabilities

LittleDaemon propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit CVE-2023-38831 (a WinRAR vulnerability) to drop loader payloads. Its C2 infrastructure uses HTTPS over port 443 with domain-generation algorithm (DGA) fallback, employing encrypted JSON-based communications to exfiltrate stolen data in 64KB chunks. Persistence is achieved via Windows scheduled tasks and registry run keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API unhooking, process hollowing of legitimate Windows binaries like svchost.exe, and checks for sandbox environments by detecting VMware and VirtualBox drivers.

📜 History & Notable Incidents

The first known LittleDaemon campaign occurred in July 2024 targeting a Taiwanese government ministry, as reported by the Taiwan Computer Emergency Response Team (TWCERT/CC) in August 2024. A second wave in October 2024 hit three Indian educational institutions, with stolen credentials later posted on a Telegram channel operated by TA883. No law enforcement actions have been publicly documented as of March 2025.

🔍 Detection Indicators

Known file hashes include SHA256 9a3b1f2e8c4d7a0b5f6e1c2d3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2 for the loader DLL and 1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2 for the payload binary (sourced from Cyble’s August 2024 report). Behavioral indicators include outbound HTTPS connections to IPs in the 103.xxx.xxx.xxx range (AS4837 China Unicom) and creation of the mutex LD_MUTEX_2024. Network IOCs feature User-Agent strings mimicking Chrome 120.0.6099.110.

☠️ Risk & Impact

LittleDaemon exfiltrates browser credentials, VPN configuration files, and email client data, with one campaign stealing over 50 GB of sensitive documents from a Taiwanese government server. The malware’s targeting of critical infrastructure sectors — government, education, and healthcare — raises the risk of downstream supply-chain attacks and espionage-driven data breaches.

🛡️ Mitigation

Defenders should deploy YARA rules matching the DLL loader hashes, block C2 IPs on perimeter firewalls, and disable macros in Office documents received from untrusted sources. Cyble’s MITRE ATT&CK mapping includes T1566.001 (Spearphishing Attachment), T1059.005 (Visual Basic), and T1573.002 (Asymmetric Cryptography); detection rules for these techniques are available in the Cyble Research and Intelligence Labs (CRIL) report published August 2024.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.