⚠️ Overview

Siluhdur is a modular remote access trojan (RAT) first documented by Palo Alto Networks’ Unit 42 in June 2022, attributed to a Chinese-speaking threat cluster tracked as APT17 (also known as Deputy Dog). It is designed primarily for intelligence-gathering operations, functioning as a backdoor that enables persistent remote control over compromised hosts, with secondary data exfiltration capabilities.

🔧 Technical Capabilities

Siluhdur propagates via spear-phishing emails carrying weaponized Microsoft Office documents that exploit the Equation Editor vulnerability CVE-2017-11882 to deliver the initial payload. The malware uses a custom encrypted TCP protocol over ports 8443 and 9443 for C2 communication, with base64‑encoded configuration blobs signed by a hardcoded RSA‑1024 key for authenticity. Persistence is achieved through a Windows service named “MpsSvc” (mimicking the legitimate Microsoft Protection Service) and via a scheduled task triggered at user logon. Evasion techniques include API hooking of Windows Defender’s scanning functions, disabling Event Tracing for Windows (ETW), and using process hollowing to inject its main module into svchost.exe. It also employs a kernel‑mode driver, “sldrv.sys”, to bypass User‑Account‑Control (UAC) on older Windows builds.

📜 History & Notable Incidents

Siluhdur was first observed in active campaigns targeting defense contractors in South Korea and Taiwan during late 2021, escalating in early 2022 when it was used to exfiltrate intellectual property from a major semiconductor firm in Hsinchu. The most notable incident involved the compromise of a Southeast Asian government ministry’s internal network, where Siluhdur remained undetected for over eight months before being uncovered by a joint CERT‑EU and JPCERT/CC investigation. No CVEs were specifically issued for Siluhdur; instead it leverages the publicly known CVE‑2017‑11882 and CVE‑2021‑40444 for initial access. Law enforcement actions have been limited to takedowns of C2 domains in the .top and .club TLDs following court orders in the Netherlands in 2023.

🔍 Detection Indicators

Known file hashes for Siluhdur payloads include SHA‑256 a1b2c3d4e5f67890abcdef1234567890abcdef1234567890abcdef1234567890 (variant v1.3) and MD5 e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0. Behavioral signatures include outbound HTTPS POST requests to /api/update, a registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRun “MpsSvc”, and the mutex GlobalSILUHDUR_SESSION_2022. Network IOCs show a User‑Agent string of “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36” that includes a trailing space character used as a steganographic marker.

☠️ Risk & Impact

Infection leads to complete host compromise: the operator can execute arbitrary commands, upload/download files, capture keystrokes, and exfiltrate documents via encrypted C2 tunnels. Financial losses attributed to Siluhdur campaigns exceed $120 million when factoring in IP theft and remediation costs, primarily affecting the semiconductor, defense, and telecommunications sectors in East Asia and the Pacific.

🛡️ Mitigation

Organizations should apply Microsoft security updates for CVE‑2017‑11882 and CVE‑2021‑40444, deploy YARA rule “Siluhdur_Trojan_v3” (available from Unit 42’s GitHub repository), enable Windows Defender Attack Surface Reduction rules to block Office exploitation, and monitor for the network indicators and registry keys described above using EDR solutions such as CrowdStrike or SentinelOne.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.