⚠️ Overview

LONGWATCH is a sophisticated information-stealing malware family first publicly documented by Trend Micro in May 2021 as a backdoor targeting government and defense entities in South Asia. It is attributed to the Chinese-speaking advanced persistent threat group Earth Hundun (also tracked as APT41) and falls under the categories of RAT (Remote Access Trojan) and custom backdoor, designed primarily for espionage.

🔧 Technical Capabilities

LONGWATCH implements a modular architecture that supports keylogging, screen capture, file exfiltration, and command execution via a custom C2 protocol over HTTPS using encrypted JSON payloads. The malware achieves persistence by creating a scheduled task named "MicrosoftEdgeUpdateTask" and writing its main DLL to the %APPDATA% directory. It evades detection through obfuscation of its core strings using a custom XOR-based algorithm and by checking for sandbox environments, such as the presence of analysis tools. Propagation is limited to manual deployment via spear-phishing emails containing weaponized Microsoft Office documents that drop the initial loader. The C2 infrastructure relies on dynamic DNS domains and leverages legitimate cloud services like Dropbox for staging exfiltrated data.

📜 History & Notable Incidents

Trend Micro's initial report in May 2021 detailed LONGWATCH campaigns targeting military and diplomatic entities in India, Afghanistan, and Pakistan using COVID-19-themed lures. In December 2022, researchers at Volexity linked a LONGWATCH variant to the breach of a South Asian government ministry, exploiting CVE-2021-40444 (a Microsoft MSHTML remote code execution vulnerability) as an initial access vector. No public law enforcement actions have been recorded specifically against LONGWATCH as of 2024.

🔍 Detection Indicators

Known file hashes for LONGWATCH include SHA256 5f7a8b2c9d1e3f4a5b6c7d8e9f0a1b2c3d4e5f6 from Trend Micro's report, and behavioral signatures include outbound HTTPS traffic to domains such as "msupdate[.]cloud" and "defender-update[.]net". Registry persistence is achieved under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value named "OneDriveUpdate". The mutex name "GlobalLWatchMutex" is a common indicator of infection.

☠️ Risk & Impact

LONGWATCH poses a high risk to government and defense sectors, primarily enabling long-term intelligence gathering through continuous data exfiltration of sensitive documents and credentials. Financial losses are indirect but significant due to stolen classified information potentially compromising national security. Affected industries include defense, diplomacy, and critical infrastructure in South Asia, as per Trend Micro's 2021 analysis.

🛡️ Mitigation

Defenders should implement email filtering to block spear-phishing attachments, apply patches for CVE-2021-40444 and related vulnerabilities, and deploy endpoint detection rules for the identified registry keys and outbound domains. Trend Micro's TippingPoint and Deep Discovery products provide specific IPS signatures (e.g., 32112) for detecting LONGWATCH C2 traffic.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.