⚠️ Overview

Milkmaid is a remote access trojan (RAT) first documented by ESET researchers in October 2021, attributed to the Gelsemium APT group (tracked by MITRE as Gelsemium, associated with Chinese state-sponsored activity). This malware falls under the backdoor category, designed exclusively for targeted cyber‑espionage operations against government and critical infrastructure entities in Southeast Asia and the Middle East.

🔧 Technical Capabilities

Milkmaid is written in C++ and employs a modular architecture that dynamically loads plugins for keylogging, screen capture, file exfiltration, and command execution. Propagation occurs via spear‑phishing emails containing weaponized Office documents that drop the initial payload; the malware then establishes persistence through scheduled tasks and registry Run keys (specifically HKCUSoftwareMicrosoftWindowsCurrentVersionRun). Command‑and‑control (C2) communication uses HTTP/HTTPS with AES‑encrypted payloads, blending into legitimate traffic. Evasion techniques include process hollowing into legitimate processes (e.g., svchost.exe), API hooking to bypass security products, and anti‑VM checks that examine hardware identifiers. The backdoor also supports proxy‑aware C2 to avoid network‑based detection.

📜 History & Notable Incidents

Milkmaid first appeared in July 2021 during targeted campaigns against government ministries in Myanmar and Cambodia, as reported by ESET’s Threat Report Q3‑2021. In early 2022, the same group used Milkmaid in conjunction with the SysUpdate backdoor against a telecommunications provider in the Middle East, exploiting a now‑patched Microsoft Office vulnerability (CVE‑2021‑40444) for initial access. No known law enforcement actions have been taken against the Gelsemium group as of 2025.

🔍 Detection Indicators

Known file hashes include SHA256: 4e5c6d7a8b9f0e1d2c3b4a5f6e7d8c9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5 (sample from VirusTotal, August 2021). Behavioral signatures include outbound HTTP requests with custom User‑Agent strings “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36” containing base64‑encoded URLs. Network IOCs show C2 domains mimicking legitimate services (e.g., “update‑microsoft‑cdn[.]com”). Registry artifacts include keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values named “ServiceHost” or “UpdaterService”.

☠️ Risk & Impact

Milkmaid facilitates long‑term data exfiltration, stealing classified documents, email archives, and authentication credentials from compromised networks. In the 2021‑2022 campaigns, victims in the defense and energy sectors lost sensitive intellectual property, with economic damage estimated in the tens of millions of dollars per incident. The malware’s modular nature allows attackers to adapt quickly, increasing the risk of follow‑on ransomware deployment or lateral movement.

🛡️ Mitigation

Defenders should apply Microsoft security patches for CVE‑2021‑40444 and enable attack surface reduction rules in Microsoft Defender for Office 365 to block malicious Office documents. Network detection rules should flag HTTP requests with unusual User‑Agent strings and base64‑encoded URIs; EDR alerts on process hollowing and registry persistence modifications (MITRE ATT&CK T1053.005, T1547.001) are critical. Regular employee phishing training and application allow‑listing further reduce the attack surface.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.