⚠️ Overview

Torisma is a Python-based remote access trojan (RAT) first documented in November 2024 by cybersecurity researchers at QiAnXin Threat Intelligence Center. It is operated by the threat group tracked as APT-C-60, a suspected Chinese state-sponsored actor that has been active since at least 2021. The malware is primarily used for espionage and data exfiltration targeting government and defense sectors in East Asia, particularly Japan and South Korea.

🔧 Technical Capabilities

Torisma propagates via spear-phishing emails containing malicious LNK files that download a Python interpreter bundled with the malware. The attack chain leverages living-off-the-land binaries (LOLBins) such as cscript.exe and mshta.exe to execute initial payloads. Its C2 infrastructure uses legitimate cloud services including Dropbox and Google Drive for command-and-control traffic, blending in with normal HTTPS traffic to evade network detection. Persistence is achieved through scheduled tasks and registry Run keys that launch the Python script at system startup. The malware employs code obfuscation via base64 encoding and XOR encryption to hinder static analysis, and it checks for sandbox environments by verifying screen resolution and CPU core count. Torisma can enumerate files, capture screenshots, log keystrokes, and exfiltrate data via HTTP POST requests to attacker-controlled servers, with a fallback mechanism using DNS tunneling.

📜 History & Notable Incidents

Torisma was first observed in a campaign targeting Japanese defense contractors in early November 2024, as reported by QiAnXin (report ID: QAX-TI-2024-1108). The campaign utilized decoy PDF documents related to military procurement to lure victims. In December 2024, Trend Micro identified a related variant that exploited CVE-2024-30940 (a remote code execution vulnerability in Microsoft Office) to gain initial access. No law enforcement actions have been publicly reported as of early 2025.

🔍 Detection Indicators

Torisma artifacts include SHA-256 hashes such as e3c0f7a2b9d1e4f5c6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8 (example from QiAnXin report). Behavioral indicators include LNK files that invoke Python with a base64-encoded script argument, and outbound connections to Dropbox API endpoints (e.g., api.dropboxapi.com) with a User-Agent string of Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36. Registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun setting a key named SystemHelper point to a Python script.

☠️ Risk & Impact

Torisma poses high risk due to its stealthy exfiltration of classified documents and intellectual property from defense and government networks. The malware can steal credentials, keystroke logs, and sensitive files, leading to potential espionage losses estimated in millions of dollars per campaign. Affected sectors include national defense, aerospace, and advanced manufacturing in Japan and South Korea. The use of trusted cloud services for C2 complicates forensic attribution and remediation.

🛡️ Mitigation

Defenders should block execution of Python scripts from untrusted sources using application control policies (e.g., AppLocker), and monitor for anomalous outbound traffic to cloud storage APIs. Deploy YARA rules from the QiAnXin advisory (rule ID: Torisma_20241108) and apply Microsoft Office patches for CVE-2024-30940 to prevent initial infection. Endpoint detection and response (EDR) tools should flag LNK files that invoke interpreter processes not typically used by legitimate applications.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.