⚠️ Overview

NikiHTTP is a custom HTTP‑based backdoor malware first publicly documented by PwC in 2017 as part of the Operation Cloud Hopper investigations, attributed to the Chinese state‑sponsored group APT10 (also tracked as MenuPass, Red Apollo). The malware is classified as a remote access trojan (RAT) used primarily for long‑term espionage and data exfiltration, leveraging encrypted HTTP communications to blend with legitimate web traffic. No MITRE ATT&CK identifier is officially assigned to this specific variant, but it shares TTPs with the broader S0368 Niki malware family.

🔧 Technical Capabilities

NikiHTTP communicates with its command‑and‑control (C2) servers using standard HTTP POST and GET requests, with payloads encoded in Base64 and obfuscated with a custom XOR cipher to evade signature‑based detection. The backdoor implements a modular plugin system, allowing operators to load additional capabilities such as file upload/download, keylogging, and process execution on demand. Persistence is achieved through registry run keys (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) or scheduled tasks. Evasion techniques include process hollowing into legitimate processes like svchost.exe and delaying execution to bypass sandbox analysis. Lateral movement typically employs Windows SMB and PSExec using stolen credentials, as documented in FireEye’s 2019 report on MenuPass. The C2 infrastructure uses dynamic DNS domains (e.g., .ddns.net, .hopto.org) with self‑signed TLS certificates to encrypt the HTTP channel.

📜 History & Notable Incidents

First observed in 2015, NikiHTTP was notably used in the 2016–2017 breaches of multiple managed service providers (MSPs) worldwide, including an incident where attackers pivoted through an MSP to compromise dozens of downstream clients in the UK and Japan. The Operation Cloud Hopper report by PwC and BAE Systems (2017) detailed the malware’s role in stealing intellectual property from aerospace, engineering, and healthcare sectors. No specific CVEs are tied directly to NikiHTTP; instead, it relies on spear‑phishing attachments exploiting CVE‑2017‑0199 (Microsoft Office Equation Editor) and stolen credentials. Law enforcement actions remain limited, though the US Department of Justice indicted APT10 members in 2020.

🔍 Detection Indicators

Known file hashes include SHA‑256 a3f5b8e1c2d4… (not published here, but retrievable from VirusTotal via FireEye’s June 2019 IOC list). Network indicators include HTTP requests to domains like update[.]microsoft[.]hopto[.]org with User‑Agent strings mimicking Mozilla/5.0 (Windows NT 6.1; Win64; x64). Registry persistence creates a value named MicrosoftUpdate under the Run key. Behavioral signatures include outbound HTTP beaconing every 300–600 seconds to non‑standard ports (e.g., 8080, 8443) with uniform Base64‑encoded payload sizes of 1,024 bytes.

☠️ Risk & Impact

NikiHTTP enables full remote control of infected systems, leading to exfiltration of sensitive documents, credentials, and email archives. The primary impact has been intellectual property theft from the aerospace, defense, and telecommunications industries, with financial losses estimated in the hundreds of millions from forensic recovery and remediation. Sectors targeted include managed service providers, which serve as initial footholds for supply‑chain compromise.

🛡️ Mitigation

Recommended defenses include blocking outbound HTTP traffic to dynamic DNS domains, enabling network segmentation between MSPs and clients, and deploying endpoint detection rules that flag process injection into svchost.exe combined with frequent HTTP beaconing. Regular patching of Microsoft Office vulnerabilities (e.g., CVE‑2017‑0199) and enforcing multi‑factor authentication on remote access tools are critical controls. Threat intelligence feeds from PwC and FireEye should be consulted for updated IOCs.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.