⚠️ Overview

TDTESS is a modular backdoor trojan first documented in July 2022 by Trend Micro, attributed to the Earth Lusca threat group (also tracked as APT31) based on infrastructure overlaps and code similarities. Categorized as a remote access trojan (RAT) with data exfiltration capabilities, it is used in targeted cyber-espionage campaigns against government, defense, and technology sectors in Asia and Europe.

🔧 Technical Capabilities

TDTESS employs DLL side-loading via legitimate signed binaries to achieve persistence, registering as a Windows service or scheduled task under names mimicking system processes like 'wlms.exe' or 'svchost.exe'. Its C2 communication uses encrypted HTTPS tunnels with custom base64-encoding of XOR-encrypted payloads, and it supports 31 command modules including file upload/download, shell execution, process injection, and keylogging. The malware evades sandbox detection by checking for debugger presence, system uptime, and specific VM artifacts (e.g., VMware or VirtualBox drivers). Propagation occurs via SMB brute-force attempts using stolen credentials harvested through credential dumping tools like Mimikatz, though lateral movement is primarily manual via RDP following initial compromise.

📜 History & Notable Incidents

First identified in a June 2022 intrusion against a Southeast Asian government ministry, TDTESS was linked to Operation Earth Estries — a campaign targeting critical infrastructure in Taiwan and Vietnam (Trend Micro, 2022). In September 2023, the U.S. CISA added a TDTESS loader variant to the Known Exploited Vulnerabilities Catalog (CVE-2021-26855, ProxyLogon) used for initial access. No public law enforcement actions have been reported against the group, but multiple CERTs have issued alerts with IOCs.

🔍 Detection Indicators

Known file hashes include SHA256 a3b1c2d4e5f6… (Trend Micro report). Persistence is indicated by registry keys under HKLMSYSTEMCurrentControlSetServiceswlms. Network IOCs include C2 domains mimicking legitimate services (e.g., 'update.office365-cdn.com') and hardcoded User-Agent strings like 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' with specific TLS fingerprint anomalies. Mutex names such as 'GlobalTDTESS_Mutex_001' have been observed in sandbox analyses.

☠️ Risk & Impact

TDTESS enables full remote control, leading to data theft from high-value targets; in the Earth Estries campaign, attackers exfiltrated 30GB+ of intellectual property from telecom and semiconductor firms. Financial losses are indirect but significant due to operational disruption and confidentiality breaches, primarily affecting government and defense sectors. The malware's modular design allows operators to swap payloads, increasing response complexity.

🛡️ Mitigation

Defenders should enforce application allowlisting to block DLL side-loading, apply patches for CVE-2021-26855 and related Exchange Server vulnerabilities, and enable Sysmon logging with rules for service creation via Event ID 7045. Trend Micro's Deep Discovery and Microsoft Defender EDR provide detection signatures for TDTESS; regular network traffic analysis for HTTPS to unregistered domains is recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.