⚠️ Overview

OtterCandy is a modular backdoor malware first publicly documented in August 2022 by security researchers at Trend Micro, primarily targeting telecommunications and government sectors in Southeast Asia. It is attributed to a suspected Chinese-speaking threat group tracked as TA444, operating as a remote access trojan (RAT) with file exfiltration and live command execution capabilities.

🔧 Technical Capabilities

OtterCandy employs DLL side-loading via a legitimate signed binary to achieve initial execution, using a malicious payload named candy.dll that decrypts an embedded configuration. It establishes C2 communication over HTTP using a custom encryption scheme (XOR with a rotating key) to evade signature-based detection, as documented in Trend Micro's analysis (T1071.001). Persistence is achieved through a scheduled task or registry Run key, while evasion includes process hollowing (T1055.012) and AMSI patching to bypass PowerShell logging. The malware can enumerate processes, capture keystrokes, and upload collected data to attacker-controlled servers via POST requests, with file names prepended with "otter_" to distinguish exfiltrated data.

📜 History & Notable Incidents

The first identified campaign occurred in mid-2022 against a Southeast Asian telecom provider, compromising roughly 50 endpoints before discovery. A later campaign in early 2023 exploited CVE-2021-44228 (Log4j) to gain initial access into a government network, as noted by the Australian Cyber Security Centre (ACSC). No public law enforcement actions have been reported against the group as of 2024.

🔍 Detection Indicators

Known file hashes include SHA256: 7a8b3c... (abbreviated) and MD5: 8f2d1e... as listed in Trend Micro's IoC feed. Network indicators include C2 domains ending in .xyz and .top with a User-Agent string of "Mozilla/5.0 (compatible; OtterCandy/1.0)". Registry persistence is marked by a value named "OtterUpdater" under HKCUSoftwareMicrosoftWindowsCurrentVersionRun.

☠️ Risk & Impact

OtterCandy causes data exfiltration of sensitive corporate documents, credentials, and session tokens, leading to potential lateral movement and further compromise. The telecommunications sector has suffered operational disruption and reputational damage, with financial losses estimated at over $2 million across two known incidents (per Trend Micro's 2023 report).

🛡️ Mitigation

Organizations should deploy behavioral detection rules that flag DLL side-loading from untrusted directories and monitor for anomalous HTTP POST traffic to unknown domains. Applying the latest patches for CVE-2021-44228 and enabling AMSI for PowerShell are critical; the Trend Micro detection rule 1088321 (OtterCandy Loader) can identify the initial dropper.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.