funnyswitch
FunnySwitch is a .NET backdoor associated with the China-aligned espionage group FishMonger, which is also tracked as Earth Lusca, TAG-22, Aquatic Panda, Red Dev 10, and RedHotel in the provided reporting. It is described as tailored malware used in specific operations and is part of a broader toolset that includes ShadowPad, Spyder, Cobalt Strike, SprySOCKS, and BIOPASS RAT. Reporting states FunnySwitch is typically loaded via DLL search order hijacking. Separate reporting noted a JScript execution feature implemented through SharpJSHandler that resembled functionality seen in FunnySwitch, which had been linked to APT41, but no broader tooling overlap was established in that case. The surrounding campaigns and actor reporting indicate targeting of high-value organizations, especially government entities, with broader activity also affecting sectors such as telecommunications, academia, aerospace, media, R&D, NGOs, think tanks, and Catholic organizations across Asia, Europe, and North America. No FunnySwitch-specific indicators of compromise were directly provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.
FunnySwitch is a .NET backdoor typically loaded via DLL search order hijacking.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
FishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.
A named tool in FishMonger’s toolset; no further technical detail is provided in the content.
A tailored malware family used for specific operations against high-value targets.
.NET backdoor used by RedHotel, typically executed via DLL search order hijacking (commonly alongside legitimate McAfee components) to load an in-memory payload and establish C2.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.