🇨🇳 CN2 malware families

Boyusec

Also known asboyusec

Boyusec is an internet security firm referenced in reporting as having ties to China’s Ministry of State Security (MSS). According to the provided content, beginning in 2011, hackers from Boyusec compromised the networks of three companies. No additional high-confidence details on targets, tactics, techniques, sub-groups, or other aliases are provided in the source content.

Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

Start free trial

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

MITRE ATT&CK

Tradecraft

7 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

7 of 15 tactics13 techniques×N= number of intelligence reports citing this technique

MITRE ATT&CK

TA0042

Resource Development

1 technique

T1587

Develop Capabilities

T1587.001

Malware

TA0001

Initial Access

2 techniques

T1078

Valid Accounts

T1566

Phishing

T1566.001

Spearphishing Attachment

T1566.002

Spearphishing Link

TA0003

Persistence

1 technique

T1078

Valid Accounts

TA0004

Privilege Escalation

1 technique

T1078

Valid Accounts

TA0005

Stealth

1 technique

T1078

Valid Accounts

TA0009

Collection

2 techniques

T1213

Data from Information Repositories

T1560

Archive Collected Data

TA0011

Command and Control

1 technique

T1090

Proxy

T1090.003

Multi-hop Proxy

ARSENAL

Associated malware families

2 malware families attributed to this actor across reporting.

FamilyContextEvidenceLast seen

exeproxyWith such access, the co-conspirators would typically install other tools on victim computers, including malware the co-conspirators referred to as “ups” and “exeproxy.”1May 26, 2026

upsWith such access, the co-conspirators would typically install other tools on victim computers, including malware the co-conspirators referred to as “ups” and “exeproxy.”1May 26, 2026

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

csis chinese espionageNews

Feb 13, 2026

Survey of Chinese Espionage in the United States Since 2000 | Strategic Technologies Program | CSIS

China-linked intrusion activity attributed to individuals associated with Boyusec; multi-year compromises of corporate networks to access confidential documents, internal communications, and credentials.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.

Start free trial

Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping7

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal2

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.