⚠️ Overview

TinyZ is a remote access trojan (RAT) first documented in December 2019 by Zscaler ThreatLabz, attributed to the Chinese-speaking threat group RedDelta (also tracked as APT10 or Stone Panda). It is a lightweight, fileless backdoor written in C++ that serves as a downloader for second-stage payloads, primarily targeting government, defense, and telecommunications sectors in Southeast Asia and the United States.

🔧 Technical Capabilities

TinyZ propagates via phishing emails containing malicious Office documents that exploit CVE-2017-11882 (Microsoft Office Equation Editor memory corruption) or CVE-2018-0798 (Microsoft Word remote code execution). Once executed, it downloads an encrypted payload from a C2 server using HTTP POST requests with a custom User-Agent string: "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0)". The backdoor achieves persistence by creating a scheduled task named "MicrosoftEdgeUpdateTaskMachine" or a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Its evasion techniques include API hashing to obfuscate imported functions, anti-debugging checks via IsDebuggerPresent(), and storing configuration data in the registry under HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced. The malware uses encrypted C2 communication over HTTPS, with a custom XOR-based cipher, and can execute remote commands, enumerate processes, and exfiltrate files.

📜 History & Notable Incidents

First observed in December 2019, TinyZ was deployed in a campaign targeting Indian government entities in March 2020, as reported by Zscaler. In June 2021, the variant TinyZ was used in a supply-chain attack against a South Korean defense contractor, leveraging compromised software update servers. No CVEs are directly associated with TinyZ itself; it exploits known Office vulnerabilities (CVE-2017-11882, CVE-2018-0798). Law enforcement actions have not been publicly documented.

🔍 Detection Indicators

Known file hashes include SHA256 5b8f5c6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4 (sample from Zscaler report) and MD5 e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6. Network indicators include C2 IPs such as 185.141.27.149 and domain cdn-update2[.]com. Registry key HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced contains Base64-encoded configuration data. Mutex name GlobalTinyZ_Mutex is used to prevent multiple instances.

☠️ Risk & Impact

TinyZ enables persistent remote access, leading to data exfiltration of sensitive government and defense documents. Zscaler reports that the malware has been used to steal intellectual property from telecommunications firms, with estimated economic losses in the tens of millions of dollars. Affected sectors include government (India, Vietnam), defense (South Korea), and telecommunications (US).

🛡️ Mitigation

Apply Microsoft security updates for CVE-2017-11882 and CVE-2018-0798; block the C2 domains and IPs in proxy and firewall rules; deploy endpoint detection with YARA rules matching the TinyZ mutex and registry keys; use email filtering to block phishing attachments with Office exploits.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.