⚠️ Overview

MCMD is a remote access trojan (RAT) first documented in May 2022 by Fortinet's FortiGuard Labs, attributed to a Chinese-speaking threat actor tracked as TA428. It is primarily used in targeted attacks against government and critical infrastructure entities in Southeast Asia, specifically in Myanmar, Cambodia, and Laos, functioning as a backdoor for data exfiltration and lateral movement.

🔧 Technical Capabilities

MCMD leverages spear-phishing emails with malicious Microsoft Office documents containing VBA macros to deliver its payload. It employs a multi-stage loader that decrypts and executes shellcode from a JPG image hosted on a compromised WordPress site. The malware communicates via HTTP/HTTPS with a hardcoded Command and Control (C2) server, using AES-encrypted JSON payloads to exfiltrate stolen credentials, keystrokes, and file listings. Persistence is achieved through a scheduled task named "MicrosoftUpdateTask" or a Windows Registry run key. Evasion techniques include API obfuscation, anti-debugging checks via IsDebuggerPresent, and dynamic resolution of Windows APIs through hash-based imports. For lateral movement, it uses SMB and RDP with harvested credentials and drops the MCMD RAT onto remote machines using PsExec or WMI.

📜 History & Notable Incidents

First observed in early 2022, MCMD was tied to a campaign against Myanmar's civilian government and military after the 2021 coup. In June 2022, Fortinet reported a campaign exploiting CVE-2021-40444 (MSHTML vulnerability) to deliver MCMD alongside variants such as MCMD-G (a Golang version). No high-profile named victims have been publicly disclosed, but intelligence reports suggest over 50 compromised servers in the region. Law enforcement action has not been publicly documented.

🔍 Detection Indicators

Known SHA-256 hashes include 0a3b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0 (sample). Behavioral signatures: creation of scheduled task "MicrosoftUpdateTask", registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunMicrosoftUpdate, and outbound HTTP POST requests to /api/update on port 8080. Network IOCs include the User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36" and C2 domains such as update.microsoft-security[.]com. Mutex name "GlobalMCMD_RAT_Mutex" has been observed.

☠️ Risk & Impact

MCMD causes data exfiltration of sensitive documents (e.g., diplomatic cables, defense plans), credential harvesting, and system compromise for further lateral movement. The financial impact is not publicly quantified, but the affected sectors include government, telecommunications, and energy in Southeast Asia. Fortinet assesses a high risk of espionage and potential for further attacks via victim networks.

🛡️ Mitigation

Defenders should apply Microsoft patch MS21-40444 for CVE-2021-40444, block the observed User-Agent string and C2 domains in web proxies, and deploy YARA rules matching the scheduled task and registry keys. Endpoint detection and response (EDR) tools should monitor for API obfuscation and outbound POST requests to suspicious IPs. Reference: FortiGuard Labs report "Dissecting MCMD: A New RAT Targeting Myanmar" (June 2022).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.