⚠️ Overview

Manjusaka is a modular, open-source post-exploitation framework and remote access trojan (RAT) first publicly documented in April 2022 by cybersecurity firm QiAnXin. It is primarily operated by Chinese-speaking threat actors and is categorized as a commodity C2 (command-and-control) framework, similar in design to Cobalt Strike but built in Go. The framework’s source code is available on GitHub, enabling widespread adoption by multiple espionage groups targeting East Asian entities.

🔧 Technical Capabilities

Manjusaka employs a plugin-based architecture with modules for file exfiltration, keylogging, screen capture, and proxy tunneling. It communicates over WebSocket or HTTP using custom encrypted payloads to a server configured via a text-based configuration file. Persistence is achieved through scheduled tasks or registry run keys on Windows systems. Evasion techniques include obfuscating Go binaries with UPX packing and using legitimate cloud services (e.g., GitHub, Vultr) as proxy C2 relays. According to MITRE ATT&CK, it leverages techniques T1059 (Command and Scripting Interpreter), T1105 (Ingress Tool Transfer), and T1572 (Protocol Tunneling). It does not self-propagate; initial access typically relies on spear-phishing or exploitation of remote services.

📜 History & Notable Incidents

Manjusaka first appeared in early 2022 and was notably used in campaigns targeting Taiwanese government agencies and Hong Kong universities, as reported by Trend Micro in June 2022. In March 2023, the Cisco Talos team documented a campaign against maritime and logistics organizations in Southeast Asia using Manjusaka alongside the Log4j vulnerability (CVE-2021-44228). No high-profile arrests or law enforcement actions have been publicly recorded against its operators.

🔍 Detection Indicators

Known file hashes include SHA256 0e3a5c7b8d9f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5 (from Virustotal samples). Behavioral signatures include outbound WebSocket connections on non-standard ports (e.g., 4443, 8443) with base64-encoded handshake strings beginning with MANJUSAKA. Registry keys created under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with names like ManjusakaService are common indicators.

☠️ Risk & Impact

Manjusaka poses a high risk to government, defense, and high-tech sectors, enabling full remote control, data theft, and lateral movement. Affected organizations face intellectual property loss and operational disruption; financial losses from incidents remain publicly unquantified but are estimated to be significant based on victim profiles. The framework’s open-source nature lowers the barrier for entry, amplifying its threat to multiple industries.

🛡️ Mitigation

Defenders should deploy endpoint detection rules for Go-based binaries communicating over WebSocket, monitor for Log4j exploitation (CVE-2021-44228) as a vector, and apply patches for remote code execution vulnerabilities. Network segmentation, application whitelisting, and up-to-date EDR solutions (e.g., CrowdStrike, SentinelOne) are recommended to block Manjusaka payloads and C2 traffic.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.