MOONSHINE
MOONSHINE is an Android spyware and exploit-and-malware kit first publicly reported by Citizen Lab in 2019 in campaigns targeting Tibetan groups. It has also been described in joint government advisories as spyware embedded in legitimate-looking Android applications and used against Uyghur, Tibetan, and Taiwanese communities, as well as related civil society organizations. Distribution has included trojanized apps, Telegram channels, WhatsApp-delivered links, and culturally tailored lures such as an Uyghur-language Audio Quran app. Malicious apps have impersonated messaging, prayer, PDF, and utility applications.
The malware has extensive surveillance capabilities. Reporting cited in the content states MOONSHINE can access microphones, cameras, messages/chats, photos, and location data, enabling real-time monitoring. Citizen Lab described the Android framework as delivering a modular implant called Scotch, which communicated with command-and-control over WebSocket on port 10011 and downloaded plugin packages including Bourbon.jar and IceCube.jar. These plugins enabled collection of SMS messages, contacts, call logs, GPS location, camera images, microphone audio, screenshots, notifications, file upload, and shell command execution. Additional reporting states MOONSHINE management interfaces exposed capabilities such as file exfiltration, live audio capture, and screen recording, and that victim devices passed a score value to C2 servers based on granted permissions.
In the 2018-2019 Tibetan targeting documented by Citizen Lab and TibCERT, MOONSHINE used multiple Android Chrome exploits mapped to browser versions, including exploits associated with CVE-2016-1646, CVE-2016-5198, CVE-2017-5030, CVE-2017-5070, CVE-2018-6065, CVE-2018-17463, CVE-2018-17480, and CVE-2019-5825. The exploit chain attempted to force malicious URLs to open inside the Facebook app’s built-in Chrome-based webview, downloaded a loader into Facebook or Facebook Messenger directories, and achieved persistence by overwriting shared library files in legitimate apps. Citizen Lab named the operator behind that campaign POISON CARP and assessed overlap with Uyghur-focused campaigns.
The content also links MOONSHINE to broader China-aligned surveillance activity. Joint advisories from the UK NCSC and partners from Australia, Canada, Germany, New Zealand, and the United States describe MOONSHINE alongside BadBazaar as part of an ongoing digital surveillance campaign aimed at groups perceived by the Chinese state as politically sensitive. Separate reporting cited in the content associates MOONSHINE or related tooling with Earth Minotaur and notes infrastructure overlap with UPSEC, identified by Intelligence Online as Sichuan Dianke Network Security Technology Co., Ltd. Some content also states that APT15 has been reported leveraging MOONSHINE app-based Android surveillance tooling. Trend Micro and Cisco Talos reporting referenced in the content further connect the MOONSHINE exploit kit with delivery of DarkNimbus/DarkNights, while noting MOONSHINE and DarkNimbus are distinct malware families despite code overlap.
High-confidence infrastructure and behavioral details mentioned in the content include MOONSHINE management panels using titles such as SCOTCH ADMIN or LOGIN; virtually hosted management interfaces; early API documentation containing Mandarin API names; exploit-kit URLs using port 5000 paths such as /web/info and /dev/loader; and C2 communications over WebSocket port 10011. The content also notes that MOONSHINE samples may request permissions that appear relevant to app functionality while using them to collect device data.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report. | Exploit #3: Appears to be CVE-2017-5030, a bug publicly credited to security researcher Brendon Tiszka.
Exploit #2: Appears to be CVE-2016-5198, a bug publicly credited to Tencent’s Keen Security Lab via Trend Micro’s Zero Day Initiative and fixed in Chrome 54.0.2840.87. | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
Other exploits include what appears to be lightly modified versions of Chrome exploit code published on the personal GitHub pages of a member of Tencent’s Xuanwu Lab (CVE-2016-1646). | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
Exploit #8: Appears to be CVE-2019-5825 ... The specific exploit used here was written and published by Exodus Intelligence after they examined the git log for Chrome’s JavaScript engine, and found a vulnerability that had been fixed in source code, but whose patch had not yet shipped to Chrome users. | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report. | Other exploits include what appears to be lightly modified versions of Chrome exploit code published on the personal GitHub pages of a member of Qihoo 360’s Vulcan Team (CVE-2018-17480).
Exploit #4: Appears to include a CVE-2017-5070 exploit published on Qixun Zhao’s Github account of Qihoo 360’s Vulcan Team. | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
Other exploits include what appears to be lightly modified versions of Chrome exploit code published ... by a Google Project Zero member on the Chrome Bug Tracker (CVE-2018-6065). | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
Exploit #6: Appears to be CVE-2018-17463, a bug publicly credited to security researcher Samuel Groß. | We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We refer to the Android exploit and malware kit as MOONSHINE, given a number of Alcohol-related strings included by the developer. This kit has not been publicly described previous to this report.
...including RoyalCLI and RoyalDNS, Okrum, Ketrum, and Android spyware named SilkBean and Moonshine.
...linked to other tools like the MOONSHINE exploit kit and the DarkNimbus backdoor...
Techniques & procedures
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniquesThe links led to code designed to exploit web browser vulnerabilities to install spyware on iOS and Android devices.
It has been shared via Telegram channels and through links sent via WhatsApp.
"senior members of Tibetan groups received malicious links in individually tailored WhatsApp text exchanges with operators posing as NGO workers, journalists, and other fake personas."
Execution
1 techniqueWe observed POISON CARP employing a total of eight Android browser exploits and one Android spyware kit, as well as one iOS exploit chain and iOS spyware.
Stealth
1 techniqueSome infected apps mimic popular platforms like WhatsApp or Skype, while others are standalone applications designed to appear trustworthy, especially to users from the affected regions.
Collection
3 techniquesThese two spywares hid inside legitimate-looking Android apps, acting essentially as “Trojan” malware, with surveillance capabilities such as the ability to access the phone’s cameras, microphone, chats, photos, and location data...
The management interface reveals extensive surveillance capabilities, including the ability to exfiltrate files from devices as well as capture live audio and screen recordings.
The management interface reveals extensive surveillance capabilities, including the ability to exfiltrate files from devices as well as capture live audio and screen recordings.
Command and Control
2 techniques"Scotch... uses the WebSocket protocol to communicate with its C2 server"; "ws://[MoonshineSite]:10011/ws?whisky_id=..."
Each exploit ran the same shellcode, which downloaded an ARMv7 ELF binary file (which we call the Loader) from hxxp://[MoonshineSite]:5000/dev/loader.
Exfiltration
1 techniqueThe management interface reveals extensive surveillance capabilities, including the ability to exfiltrate files from devices as well as capture live audio and screen recordings.
Recent activity
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploit kit used to deliver the DarkNimbus backdoor in long-term surveillance operations.
Malware referenced as targeting mobile users via fake apps; details not provided in the excerpt.
Exploit kit/tooling linked to the Earth Minotaur threat cluster in the reporting.
Exploit kit tracked by Talos since 2023 and associated in this reporting with delivery of mobile exploits alongside the DarkNimbus backdoor.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.