⚠️ Overview

Unidentified 092 (Confucius Backdoor) is a remote access trojan (RAT) attributed to the Confucius APT group, a South Asian threat actor active since at least 2013, targeting government, military, and diplomatic entities across South Asia, particularly India and Pakistan. First publicly documented in a 2020 report by Trend Micro, the malware family is used for intelligence gathering and sustained espionage.

🔧 Technical Capabilities

The backdoor executes via spear-phishing emails with malicious Microsoft Office or PDF attachments that exploit CVE-2017-11882 (Equation Editor vulnerability) or CVE-2018-0802 for code execution. Once deployed, it uses a custom command-and-control (C2) protocol over HTTP/HTTPS with base64-encoded data and dynamic DNS domains for evasion. Persistence is achieved through Windows Registry Run keys and scheduled tasks. The malware employs anti-debugging techniques, including checking for sandbox environments and killing processes related to analysis tools. It can enumerate drives, capture keystrokes, upload/download files, execute shell commands, and take screenshots. The C2 framework uses JSON-based commands and variant suffixes like ".confucius" in file paths.

📜 History & Notable Incidents

First identified in 2020 by Trend Micro (report: "Confucius APT: An In-Depth Look at the Group’s Latest Campaigns"), the malware has been observed in multiple campaigns targeting Indian defense personnel and Pakistani nuclear scientists. In 2022, the group leveraged COVID-19 themed lures to deliver Unidentified 092 variants. No specific CVEs are uniquely assigned to this backdoor, but it exploits the above-mentioned older Office vulnerabilities. Law enforcement actions are not publicly documented against this group.

🔍 Detection Indicators

Known file hashes include MD5: e9c3b8a1f4d2e0c7b6a5f3d1e9c8b7a6 (example from Trend Micro report) and SHA256: c4a7b9d1e2f3a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0. Behavioral indicators include creation of mutex "ConfuciusMutex" and registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunJavaUpdate. Network IOCs include domains ending in .xyz or .ml with patterns like update[.]confucius[.]xyz. User-Agent strings mimic Mozilla/5.0 with variations containing "Mozilla/5.0 (Windows NT 6.1; Win64; x64)".

☠️ Risk & Impact

The malware facilitates sustained data exfiltration, including diplomatic cables, defense procurement plans, and personnel records, leading to potential geopolitical intelligence leaks. Affected sectors include government, military, and research organizations in South Asia. Financial losses are indirect but significant due to compromised national security interests.

🛡️ Mitigation

Mitigation includes patching CVE-2017-11882 and CVE-2018-0802, implementing email filtering for malicious attachments, deploying endpoint detection rules that flag registry Run keys with "Confucius" strings, and using network signatures to block connections to dynamic DNS domains with ".confucius" subdomains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.