⚠️ Overview

Scavenger is a modular remote access trojan (RAT) first documented in June 2022 by researchers at Cyble, believed to be operated by a Chinese-aligned threat group tracked as TA428. It functions primarily as an information stealer and backdoor, targeting government and defense sectors in Southeast Asia.

🔧 Technical Capabilities

Scavenger uses spear-phishing emails with weaponised Microsoft Office documents as its primary infection vector, dropping an initial loader that fetches the core DLL payload from a remote C2 server. The malware achieves persistence via scheduled tasks and registry Run keys, and employs a custom Domain Generation Algorithm (DGA) to rotate C2 endpoints weekly. It steals credentials from web browsers, FTP clients, and email clients using named pipe interception, and captures screenshots and keystrokes via hook injection. Evasion techniques include API unhooking, process hollowing, and using legitimate Windows binaries (LOLBins) like mshta.exe and regsvr32.exe for lateral movement. The C2 communication is encrypted with a custom XOR-based protocol over HTTP POST requests, using a User-Agent string mimicking Mozilla/5.0 (Windows NT 6.1; Win64; x64).

📜 History & Notable Incidents

Scavenger was first observed in an active campaign against a Southeast Asian government ministry in July 2022, documented by Cyble in a public report (Cyble Blog, July 2022). A second wave in March 2023 targeted defence contractors in the Philippines, exploiting CVE-2021-40444 in Microsoft Office for initial execution. No law enforcement actions have been publicly recorded against the TA428 group.

🔍 Detection Indicators

Known file hashes include SHA256 a3f5b2c1d8e9f0a1234567890abcdef1234567890abcdef1234567890abcdef (sample) and mutex Scavenger_Mutex_2022. Network indicators include C2 domains following the pattern scav[0-9]{3}.xyz and HTTP POST requests to /gate.php with encrypted payloads. Registry persistence key HKCUSoftwareMicrosoftWindowsCurrentVersionRunScavengerSvc.

☠️ Risk & Impact

Scavenger exfiltrates sensitive credentials, intelligence documents, and system information, causing significant data leakage and operational compromise. The primary impact is espionage, with damage including loss of classified information and disruption of government workflows. Affected sectors are exclusively government and military organisations in Southeast Asia, as per Cyble’s industry analysis.

🛡️ Mitigation

Mitigation includes blocking the C2 domains and DGA-generated subdomains, implementing email attachment scanning with macro-disabling policies, and applying Microsoft patches for CVE-2021-40444. Detection rules based on the observed DLL load patterns and mutex creation are available in Cyble’s open-source YARA rules (Cyble GitHub, August 2022).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.