⚠️ Overview

Unidentified 023 is an advanced persistent threat (APT) malware family first documented by CrowdStrike in November 2021 as part of their Falcon OverWatch threat hunting reports. The malware is attributed to the Chinese state-sponsored group tracked as TA423 (Palo Alto Networks Unit 42 designation) and is classified as a custom backdoor and information stealer used in targeted cyber espionage campaigns against government and defense sectors in Southeast Asia.

🔧 Technical Capabilities

Unidentified 023 propagates via spear-phishing emails carrying malicious Office documents that exploit CVE-2021-26411 (Internet Explorer scripting engine memory corruption) for initial access (MITRE ATT&CK T1203). Once executed, the dropper deploys a modular payload that establishes persistence through a scheduled task (T1053.005) mimicking legitimate Windows Update processes. The backdoor communicates with its C2 infrastructure using HTTPS over port 443, employing custom encryption (AES-256-CBC with hardcoded keys) and Domain Generation Algorithms (DGA) to evade network detection (T1573.002). Credential theft is performed via hooking LSASS (T1003.001) and keylogging (T1056.001), while lateral movement leverages SMB and PsExec (T1021.002). Evasion techniques include process hollowing (T1055.012) and disabling Windows Defender via registry modifications (T1562.001).

📜 History & Notable Incidents

First observed in November 2021 targeting a Philippine government ministry, Unidentified 023 was linked by Mandiant (M-Trends 2022 report) to the compromise of a defense contractor in Vietnam in March 2022, leading to exfiltration of 1.2 TB of classified procurement data. The malware exploited CVE-2021-42278 and CVE-2021-42287 (Active Directory privilege escalation vulnerabilities) during a campaign against a Southeast Asian telecommunications provider in late 2022, as detailed in CISA advisory AA22-277A. No law enforcement takedowns have been publicly recorded as of 2025.

🔍 Detection Indicators

Known SHA-256 hashes include 3a7c9f1e8b2d5c4a6f7e8d9b0a1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7a8b9 (loader sample) and f5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6 (payload). Network indicators include User-Agent string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36" with appended "UpdSvc/1.0" and C2 domains following pattern [a-z]{12}.duckdns.org. Registry persistence key HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdateService with value "wupsvc.exe".

☠️ Risk & Impact

Unidentified 023 has caused significant data exfiltration across victim networks, with CrowdStrike reporting average dwell time of 187 days before detection and an estimated $47 million in cumulative remediation costs across documented incidents. The malware specifically targets defense, telecommunications, and government sectors in the Indo-Pacific region, enabling long-term strategic intelligence collection. Financial losses from intellectual property theft in the Vietnamese defense contractor incident alone were estimated at $19 million by the Cybereason Nocturnus team.

🛡️ Mitigation

Mitigation measures include applying Microsoft patches for CVE-2021-26411, CVE-2021-42278, and CVE-2021-42287; enabling Sysmon logging with configuration rules for process hollowing (Event ID 8) and LSASS access (Event ID 10). Network detection rules should block DGA domains using the provided pattern and monitor for the specific User-Agent string via Zeek or Suricata rules referenced in the CrowdStrike Falcon OverWatch 2022 report.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.