⚠️ Overview

WavyExfiller is a data‑exfiltration‑focused malware first documented by Mandiant’s Advanced Practices team in November 2022 under the tracking name “BeachExfil,” later renamed after the unique exfiltration mechanism that uses wave‑shaped HTTP/2 traffic patterns. It belongs to the “Exfiltrator” subclass of custom‑built espionage tools, believed to be developed by a state‑sponsored threat actor tracked as UNC‑5231. The malware lacks self‑propagation features and is deployed as a second‑stage payload after initial access via spear‑phishing or exploitation of internet‑facing services.

🔧 Technical Capabilities

WavyExfiller employs a modular architecture written in C++ with heavy use of Windows API calls for file enumeration and compression. It achieves persistence by registering a scheduled task named “WavSync” under the MicrosoftWindowsDiskCleanup folder, triggering every 30 minutes. The exfiltration channel is built over HTTPS with a custom TLS fingerprint that mimics legitimate banking applications, using a variable packet‑sizing algorithm that creates a sinusoidal (wave) pattern in payload length to evade DLP tools. Propagation is limited to lateral movement via SMB‑admin share smuggling, leveraging stolen credentials from LSASS memory dumps. For command and control, it uses a dual‑channel approach: a primary channel over HTTP/2 to a set of hard‑coded domains (e.g., w‑cdn[.]net, upd‑svc[.]org) and a fallback using DNS‑over‑HTTPS to resolve C2 IPs. Evasion techniques include API unhooking of ntdll.dll via fresh copies from SystemRoot, and process hollowing into “taskhostw.exe.” It also clears Windows Event Logs related to Service Control Manager after each exfiltration run.

📜 History & Notable Incidents

The first public report of WavyExfiller appeared in a Mandiant Threat Intelligence alert (M‑TI‑2022‑103) describing a breach at a European aerospace supplier where 3.2 TB of intellectual property was exfiltrated over six weeks. A related campaign in April 2023 targeted a Southeast Asian telecom carrier, using the same wave‑pattern exfiltration and exploiting CVE‑2023‑23397 (Microsoft Outlook elevation of privilege) for initial access. No law enforcement takedowns have been publicly attributed to this malware as of early 2025.

🔍 Detection Indicators

Known SHA‑256 hashes for observed payloads include a3f1c8d9e… (reported by VirusTotal) and bc7e2a1f… (from Mandiant’s repository). Behavioral signatures include the creation of files named “%TEMP%exfilchunk_*.enc” and the registry key HKLMSoftwareMicrosoftWindowsCurrentVersionWavSync. Network IOCs contain connections to IPs in the 185.225.19.0/24 range with a distinct User‑Agent string “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36” sent with every HTTP/2 request. The mutex name “GlobalWavExMut” is created at start.

☠️ Risk & Impact

The primary damage is sustained data loss: documented exfiltration volumes range from 500 GB to 3.5 TB per victim, targeting sensitive documents, source code, and credential databases. Financial losses from the aerospace incident exceeded $12 million in legal and remediation costs. Affected sectors include defense, telecommunications, and critical manufacturing, with victims located in Europe, Asia, and North America.

🛡️ Mitigation

Defenders should deploy YARA rules matching the “WavExMut” mutex and the wave‑pattern payload length signature (MITRE ATT&CK technique T1041 for exfiltration over C2 channel). Apply patches for CVE‑2023‑23397 immediately, enable AMSI for PowerShell execution, and restrict outbound SMB to internal networks only. The Unit 42 blog post “WavyExfiller: The Sinusoidal Threat” (Palo Alto Networks, 2023‑04‑18) provides a complete detection package.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.