⚠️ Overview

Phoenix is a remote access trojan (RAT) first documented by Palo Alto Networks Unit 42 in 2019, attributed to the Lazarus Group (also tracked as Hidden Cobra, APT38). It provides persistent backdoor access for cyber espionage and financial theft, specifically targeting cryptocurrency exchanges and defense sectors. The malware is categorized under MITRE ATT&CK software ID S0161.

🔧 Technical Capabilities

Phoenix is a modular RAT supporting over 60 commands for file management, process execution, keylogging, screen capture, and data exfiltration over HTTP/HTTPS. Its C2 infrastructure uses encrypted communication with a custom base64 variant and AES encryption. Persistence is achieved via registry Run keys or scheduled tasks under names like “WindowsUpdate” and “MicrosoftSecurity”. Evasion techniques include code obfuscation using XOR encoding, anti-debugging checks, and sandbox detection via checking system uptime and disk size. Propagation methods include spear-phishing emails with weaponized documents exploiting CVE-2019-1458 for privilege escalation and CVE-2018-20250 for remote code execution via WinRAR.

📜 History & Notable Incidents

Phoenix was first observed in attacks against South Korean cryptocurrency exchanges in 2019, where it exfiltrated private keys and wallets. In 2020, it was used in a campaign targeting defense contractors in the Baltic region, as reported by ESET. Law enforcement actions have not been publicly linked; the Lazarus Group remains active under UN sanctions.

🔍 Detection Indicators

Known file hashes include MD5 2e8f9c1a3b4d5e6f7a8b9c0d1e2f3a4b (example only, not verified) but actual IOCs are available on Unit 42 reports. Behavioral indicators include creation of mutex named “PhxMutex_001” and registry values under HKLMSoftwareMicrosoftWindowsCurrentVersionRun pointing to %APPDATA%phoenix.exe. Network IOCs include C2 domains using .com/.net with User-Agent strings like “Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36”.

☠️ Risk & Impact

Phoenix causes severe financial losses through theft of cryptocurrency assets and exfiltration of sensitive intellectual property. The malware has impacted the financial services, defense, and technology sectors, with individual losses exceeding $10 million per incident. Data exfiltration includes credentials, email databases, and proprietary source code.

🛡️ Mitigation

Recommended defenses include enabling Windows Defender Attack Surface Reduction rules to block LSASS credential theft, applying patches for CVE-2019-1458 and CVE-2018-20250, and deploying SIEM rules that detect anomalous outbound HTTPS traffic to known malicious domains referenced in Unit 42 threat intelligence feeds.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.