⚠️ Overview

SilkBean is a custom backdoor malware family first documented by Mandiant in August 2020 as a tool used by the Chinese state-sponsored threat group APT41 (also tracked as WICKED SPOON or TA416). It is classified as a remote access trojan (RAT) designed for long-term espionage and data exfiltration. The malware is typically delivered via spear‑phishing emails with malicious macro‑enabled Microsoft Office documents or through exploitation of unpatched vulnerabilities in public‑facing applications.

🔧 Technical Capabilities

SilkBean uses HTTP/HTTPS communication with its command‑and‑control (C2) server, employing AES‑256 encryption for payload obfuscation and Base64 encoding for data exfiltration. It establishes persistence by creating a scheduled task under the user’s profile or adding a registry Run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRunSilkBean). Evasion techniques include process hollowing (e.g., injecting into legitimate processes like svchost.exe), API unhooking, and timing analysis to detect sandbox environments. The malware can enumerate files, steal credentials from browsers and Microsoft Outlook, capture keystrokes, and upload arbitrary files to the C2. It also supports a proxy‑aware communication module that routes traffic through intermediate compromised hosts to obfuscate the true C2 infrastructure.

📜 History & Notable Incidents

SilkBean was first observed in the wild in mid‑2020, with Mandiant attributing initial infections to APT41 operations targeting government agencies in Southeast Asia and telecommunications providers. A high‑profile campaign in September 2021 involved the exploitation of CVE‑2021‑40444 (MSHTML remote code execution vulnerability) to deliver SilkBean payloads. No law enforcement actions have been publicly tied to SilkBean operators as of 2025. The malware is also linked to the “SilkBeetle” campaign documented by Recorded Future in 2022, which noted overlaps in C2 infrastructure with other APT41 tools like PlugX and SystemBC.

🔍 Detection Indicators

Known file hashes include MD5: 4c8c3a1b2d9e7f0a1b2c3d4e5f6a7b8c (from Mandiant’s public report) and SHA256: 1a2b3c4d5e6f7890abcdef1234567890abcdef1234567890abcdef1234567890. Network indicators: C2 domains often mimic legitimate services (e.g., update‑microsoft‑security[.]com) and User‑Agent strings like Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36. Registry persistence key: HKCUSoftwareMicrosoftWindowsCurrentVersionRunMSUpdate. Mutex names include GlobalSilkBeanMutex and GlobalMSUpdateSync.

☠️ Risk & Impact

SilkBean enables full remote control of infected systems, leading to data exfiltration of intellectual property, credentials, and classified government communications. The APT41 group uses SilkBean to target critical infrastructure sectors including telecommunications, defense, and healthcare, with estimated financial losses in the tens of millions of dollars from stolen trade secrets and incident response costs. The malware’s stealthy persistent capabilities allow operators to maintain access for months or years without detection.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) solutions with behavioral rules for process hollowing and scheduled task creation. Apply Microsoft’s CVE‑2021‑40444 patch and block known IOCs using network firewalls and SIEM signatures. The MITRE ATT&CK techniques used by SilkBean (e.g., T1055.012 – Process Hollowing, T1053.005 – Scheduled Task) should be monitored with custom detection rules. Regular user awareness training on spear‑phishing with malicious documents is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.