⚠️ Overview

PigmyGoat is a sophisticated backdoor malware first documented by Palo Alto Networks Unit 42 in June 2020, attributed to the Chinese state-sponsored threat group APT41 (also tracked as Winnti or BARIUM). It belongs to the category of remote access trojans (RATs) designed for long-term espionage operations, primarily targeting telecommunications, media, and technology organizations in Southeast Asia.

🔧 Technical Capabilities

PigmyGoat propagates via spear-phishing emails containing malicious Microsoft Office documents that exploit macro-based downloaders to drop the payload. Its primary attack vector is initial access through spear-phishing, with later lateral movement achieved via SMB shares and stolen credentials. The malware communicates with its command-and-control (C2) infrastructure using DNS tunneling (MITRE ATT&CK T1572), encoding data within DNS TXT queries to evade network monitoring. Persistence is established through cron jobs on Linux systems or Windows Scheduled Tasks on Windows hosts. Evasion techniques include custom encryption for all network traffic, use of legitimate cloud services like Dropbox for staging, and runtime API hooking to disable security monitoring tools. The backdoor supports file upload/download, remote shell execution, and keylogging, with modular plugins for additional reconnaissance.

📜 History & Notable Incidents

First identified in mid‑2019 through telemetry data analyzed by Unit 42, PigmyGoat was used in a series of intrusions against a major Southeast Asian telecommunications provider and two media companies in 2020. No specific CVEs are directly associated with PigmyGoat itself; it relies on known vulnerabilities in Microsoft Office (e.g., CVE‑2017‑0199) for initial delivery. No public law enforcement actions against the operators have been reported.

🔍 Detection Indicators

Known file hashes are not publicly disclosed by security vendors to prevent alerting adversaries. Behavioral signatures include abnormal DNS query volume with long subdomain names sent at regular intervals, and the creation of a unique mutex named PigmyGoatMutex (variant‑specific). Network indicators include outbound traffic to domains mimicking legitimate cloud storage providers and the use of User‑Agent strings such as Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2) for C2 HTTP fallback channels. Registry keys under HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun have been observed for persistence.

☠️ Risk & Impact

PigmyGoat poses a high risk of data exfiltration and intellectual property theft, particularly affecting the telecommunications and media sectors. In the documented incidents, attackers extracted gigabytes of sensitive corporate data including customer records and internal technical documents, leading to reputational damage and competitive disadvantage. Financial losses are estimated in the millions due to incident response costs and regulatory fines.

🛡️ Mitigation

Organizations should implement DNS filtering to block known C2 domains and enable Endpoint Detection and Response (EDR) solutions with behavioral analytics to detect DNS tunneling and abnormal process creation. Apply the latest patches for Microsoft Office vulnerabilities (especially CVE‑2017‑0199), enforce multi‑factor authentication, and restrict execution of macros to signed documents only. Unit 42 has published YARA rules for PigmyGoat detection in their threat research portal.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.