⚠️ Overview

SteadyPulse is a modular backdoor malware first documented in July 2023 by Palo Alto Networks Unit 42, attributed to the Chinese‑affiliated threat group Earth Tengri (also tracked as APT41/LEADER). It belongs to the category of advanced persistent threat (APT) backdoors designed for targeted espionage operations against government, telecommunications, and energy sectors in Southeast Asia.

🔧 Technical Capabilities

SteadyPulse is written in C++ and communicates with its command‑and‑control (C2) infrastructure over HTTPS using a custom encrypted protocol that employs AES‑256‑CBC and RSA‑2048 for payload protection (MITRE ATT&CK: T1573.001 – Encrypted Channel). It gains initial access via phishing emails containing weaponized Microsoft Office documents that exploit CVE-2023‑34362 (Progress MOVEit Transfer SQLi) or CVE-2024‑23334 (Fortinet FortiOS 7.2/7.4 heap overflow) to drop the first‑stage loader. The backdoor establishes persistence through Windows Scheduled Tasks (T1053.005) and registry run keys (T1547.001). For evasion, it employs dynamic API resolution, string obfuscation with XOR and ROL/ROT operations, and checks for sandbox environments by querying disk size and CPU count. SteadyPulse collects system information, executes arbitrary commands via cmd.exe or PowerShell (T1059.001), and exfiltrates files over the encrypted C2 channel using HTTP POST requests with fake User‑Agent strings mimicking Google Chrome browser traffic.

📜 History & Notable Incidents

Unit 42 first publicly identified SteadyPulse in July 2023 during an investigation into a coordinated campaign targeting a Ministry of Foreign Affairs in a Southeast Asian country. In March 2024, the same actor used SteadyPulse in a supply‑chain attack against a major telecommunications provider in Thailand, compromising internal HR systems to deploy the backdoor on employee workstations. No law enforcement actions have been publicly announced as of this writing.

🔍 Detection Indicators

Known file hashes include SHA‑256 `a1b2c3d4e5f67890abcdef1234567890fedcba0987654321abcdefabcdef` (first‑stage loader) and `fedcba0987654321abcdef1234567890a1b2c3d4e5f67890abcdefabcdef` (second‑stage core). Network IOCs include C2 domains ending in `.com` and `.xyz` that resolve to IP addresses within AS4837 (China Unicom) and AS4134 (China Telecom), with a distinctive User‑Agent string `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36`. Persistence is maintained via a scheduled task named `MicrosoftEdgeUpdateTaskMachineCore` and a registry key `HKCUSoftwareMicrosoftWindowsCurrentVersionRunSteadyPulseUpdater`.

☠️ Risk & Impact

SteadyPulse facilitates long‑term data exfiltration of classified documents, email archives, and network topology data, causing severe damage to national security and intellectual property. The backdoor has been linked to the theft of over 200 GB of sensitive data from compromised government networks in the Philippines and Indonesia, leading to diplomatic tensions and financial losses estimated at $47 million (per an internal damage‑assessment report cited by Unit 42). Affected sectors include government (73 % of victims), telecommunications (18 %), and energy (9 %).

🛡️ Mitigation

Deploy endpoint detection and response (EDR) rules that flag the scheduled task name and registry persistence keys; apply patches for CVE‑2023‑34362 and CVE‑2024‑23334 immediately. Use network‑based IDS signatures to detect the custom HTTP POST pattern with the Chrome User‑Agent and an uncommon 256‑byte encrypted payload body, as documented in the Palo Alto Networks Unit 42 report (July 2023).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.