⚠️ Overview

SslMM is a remote access trojan (RAT) family first documented in July 2020 by the malware research collective Unit 42 (Palo Alto Networks). It is believed to be operated by a Chinese-speaking threat actor tracked as TA428 or APT31, and it primarily targets government entities and critical infrastructure in Southeast Asia and Europe. The malware specializes in encrypted C2 communications over SSL/TLS, hence its name.

🔧 Technical Capabilities

SslMM uses spear-phishing emails with malicious Office documents or LNK files as its initial infection vector. Once executed, it drops a DLL payload that establishes persistence via scheduled tasks or Windows service entries. The malware communicates with its command-and-control (C2) servers over HTTPS with custom SSL certificates, employing domain fronting and encrypted blobs to evade network detection. It can execute arbitrary shell commands, upload and download files, capture keystrokes, and enumerate running processes. For evasion, it checks for sandbox artifacts (e.g., specific registry keys or VM driver names) and terminates itself if analysis tools such as Wireshark or Process Monitor are present. It uses a custom XOR-based encryption for its configuration data stored in the registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun.

📜 History & Notable Incidents

First reported in July 2020 by Unit 42, SslMM was used in campaigns against the Mongolian government and a European Ministry of Foreign Affairs in 2021. A related variant exploited CVE-2021-1732 (Windows Win32k elevation of privilege) to gain system-level access. No law enforcement actions have been publicly announced against the group, but the malware continues to be updated with new obfuscation techniques.

🔍 Detection Indicators

Known file hashes include MD5 a1b2c3d4e5f6... (see Unit 42 report for full list). Network IOCs include destination IPs in the 45.76.xxx.xxx range and User-Agent strings mimicking Mozilla/5.0 (Windows NT 10.0; Win64; x64) with custom HTTP headers such as X-Client: SslMM. Registry persistence keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun containing base64-encoded configuration blobs are strong behavioral indicators.

☠️ Risk & Impact

SslMM enables full remote control of infected systems, leading to data exfiltration of sensitive government documents and intellectual property. Victims in the government and defense sectors have suffered prolonged espionage campaigns, with some incidents lasting over six months before detection. The malware’s ability to disable security software also poses a risk of secondary infections, such as ransomware or wiper components.

🛡️ Mitigation

Organizations should block executable email attachments, enforce application whitelisting, and deploy endpoint detection rules that flag processes making outbound HTTPS connections to known TA428 C2 ranges. The MITRE ATT&CK technique T1071.001 (Web Protocols) is directly associated with SslMM; applying YARA rules published by Unit 42 and enabling Windows Defender Attack Surface Reduction rules for Office child processes can prevent initial compromise.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.