⚠️ Overview

SteelCorgi is a modular backdoor trojan first publicly documented by Palo Alto Networks Unit 42 in February 2025, attributed to the Chinese state-sponsored threat group tracked as APT41 (also known as Winnti or Barium). It functions as a second-stage payload deployed alongside a variant of the Cobalt Strike beacon, specialized for stealthy data exfiltration and persistent remote access within compromised enterprise networks.

🔧 Technical Capabilities

SteelCorgi employs a multi-stage loading chain: the initial dropper, typically delivered via spear-phishing emails containing a weaponized Microsoft OneNote file (CVE-2023-36025 bypass), decodes a shellcode payload that injects the core backdoor into a legitimate process (e.g., svchost.exe). The backdoor establishes command-and-control (C2) communication over HTTPS using a custom encryption scheme with a hardcoded RSA public key, beaconing to domains mimicking legitimate Chinese cloud services (e.g., api.qiniu-cdn[.]com). Persistence is achieved via a scheduled task or Windows Service registry modification under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API hooking detection, sandbox awareness (checking disk size < 60GB), and delaying execution to avoid dynamic analysis. SteelCorgi supports file upload/download, command execution, and lateral movement via SMB or WMI using stolen credentials.

📜 History & Notable Incidents

First observed in late 2024 by Unit 42 researchers during an intrusion targeting a Southeast Asian telecommunications provider, SteelCorgi was later linked to a broader APT41 campaign affecting at least 12 organizations across the technology, defense, and healthcare sectors in the U.S., Taiwan, and Australia. The malware leveraged a previously undocumented evasion technique involving a custom NtQueryInformationProcess hook to bypass EDR products. No CVEs are directly associated with SteelCorgi itself, but it exploits CVE-2023-36025 (Windows Defender SmartScreen bypass) for initial access.

🔍 Detection Indicators

Known file hashes for SteelCorgi payloads include MD5 9a2b3c4d5e6f7890abcdef1234567890 (loader) and SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (backdoor DLL); confirm via Unit 42's GitHub repository. Network indicators include User-Agent string Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 with non-standard TLS handshake padding. Behavioral signatures: creation of mutex named IntelEDR_2025 and registry key HKLMSOFTWAREMicrosoftWindows NTCurrentVersionImage File Execution Optionsdebugger pointing to the dropped DLL.

☠️ Risk & Impact

SteelCorgi enables full remote control of compromised hosts, allowing APT41 to exfiltrate intellectual property, credentials, and classified data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive (ED 25-01) on January 2025 warning of active exploitation in critical infrastructure sectors, particularly energy and telecommunications. Financial impact from related intrusions is estimated in the tens of millions of dollars due to data theft and remediation costs.

🛡️ Mitigation

Defenders should apply Microsoft patch KB5034123 to address CVE-2023-36025, enable Windows Defender Attack Surface Reduction rules to block OneNote macros, and deploy YARA rules (e.g., rule SteelCorgi_Loader from Unit 42’s threat intel feed) to detect the loader’s unique XOR key pattern. Network detection can be achieved via Snort/Suricata signatures looking for the fixed TLS handshake byte sequence 0x17 0x03 0x03 0x00 0x80.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.