Skip to main content
Mallory
🇨🇳 CN11 malware familiesExploits CVEs in the wild

BackdoorDiplomacy

Also known asBackdoorDiplomacy

BackdoorDiplomacy is a Chinese state-linked cyberespionage threat actor. Reporting in the provided content describes it as targeting government entities, as well as high-priority telecommunications and finance organizations, with activity across Africa, the Middle East, and other regions of PRC interest. Recent reporting cited in the content describes a sustained three-year campaign against governmental organizations in Kenya, and targeting linked to South Africa, Kenya, Senegal, and Ethiopia. The content also notes overlap or a close relationship with APT15 and references overlap with Playful Taurus, Vixen Panda, NICKEL, and Ke3chang. Observed tradecraft in the provided content includes exploitation of public-facing applications and exposed services, including CVE-2020-5902 on F5 BIG-IP to drop a Linux backdoor and exploitation of misconfigured Plesk servers. The actor has been associated with web shell activity and IIS-related persistence, command and scripting interpreter use, and malware/tool upload behaviors. Additional behaviors described include obtaining and using leaked malware such as DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy; using SMBTouch to identify EternalBlue-vulnerable targets; obtaining open-source reconnaissance and red-team tools for discovery and lateral movement; obfuscating tools and malware with VMProtect; detecting removable media such as USB flash drives; copying files of interest to the main drive's Recycle Bin for staging; and dropping implants in folders named for legitimate software. The content also notes that a DLL sideloading chain observed by Sophos resembled a process previously described for deployment of a Merlin Agent by BackdoorDiplomacy, and that Cluster Alpha activity in Sophos' Crimson Palace investigation aligned with Bitdefender reporting on a Middle East cyberespionage campaign attributed to BackdoorDiplomacy.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Who they target

Sectors the actor has been observed targeting.

  • Government & Administration
  • Software & Services
  • Financial Services

Where they target

Geographies tied to known operations.

  • 🇰🇪 Kenya
  • 🇿🇦 South Africa
  • 🇸🇳 Senegal
  • 🇪🇹 Ethiopia

Where they're from

Attributed origin per open-source reporting.

  • CN
MITRE ATT&CK

Tradecraft

42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

11 of 15 tactics56 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
2 techniques
T1588
Obtain Capabilities
T1588.001
Malware
T1588.002×3
Tool
T1608
Stage Capabilities
T1608.001
Upload Malware
T1608.002
Upload Tool
TA0001
Initial Access
2 techniques
T1133×6
External Remote Services
T1190×22
Exploit Public-Facing Application
TA0002
Execution
3 techniques
T1059×2
Command and Scripting Interpreter
T1059.003
Windows Command Shell
T1569
System Services
T1569.002
Service Execution
T1574
Hijack Execution Flow
T1574.001×4
DLL
T1574.011
Services Registry Permissions Weakness
TA0003
Persistence
2 techniques
T1133×6
External Remote Services
T1505
Server Software Component
T1505.003×5
Web Shell
T1505.004
IIS Components
TA0005
Stealth
5 techniques
T1027×5
Obfuscated Files or Information
T1027.002×2
Software Packing
T1036
Masquerading
T1036.005
Match Legitimate Resource Name or Location
T1070
Indicator Removal
T1070.004
File Deletion
T1574
Hijack Execution Flow
T1574.001×4
DLL
T1574.011
Services Registry Permissions Weakness
T1620
Reflective Code Loading
TA0006
Credential Access
1 technique
T1003
OS Credential Dumping
T1003.003
NTDS
TA0007
Discovery
8 techniques
T1016
System Network Configuration Discovery
T1018×2
Remote System Discovery
T1046×6
Network Service Discovery
T1049
System Network Connections Discovery
T1082×2
System Information Discovery
T1083
File and Directory Discovery
T1087
Account Discovery
T1087.002
Domain Account
T1120×2
Peripheral Device Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1021.003
Distributed Component Object Model
T1550
Use Alternate Authentication Material
T1550.002
Pass the Hash
TA0009
Collection
4 techniques
T1005
Data from Local System
T1074
Data Staged
T1113
Screen Capture
T1560
Archive Collected Data
TA0011
Command and Control
5 techniques
T1071
Application Layer Protocol
T1071.001×2
Web Protocols
T1090
Proxy
T1105×9
Ingress Tool Transfer
T1572
Protocol Tunneling
T1573
Encrypted Channel
T1573.002
Asymmetric Cryptography
TA0010
Exfiltration
1 technique
T1041
Exfiltration Over C2 Channel
WEAPONIZED

Associated vulnerabilities

8 CVEs this actor has used in observed campaigns. 8 of them exploited in the wild.

CVE-2020-5902F5 BIG-IP TMUI Remote Code ExecutionIn the wildEvidence2

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.

CVE-2021-31207Post-auth Arbitrary File Write in Microsoft Exchange Server (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34473ProxyShell Autodiscover SSRF in Microsoft Exchange ServerIn the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34523Microsoft Exchange PowerShell Backend Elevation of Privilege (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2022-26134Atlassian Confluence Server and Data Center OGNL Injection RCEIn the wildEvidence1

The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.

3 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping42

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal11

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs8

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables19

Domains, IPs, and hashes tied to this actor, refreshed continuously.