EAGERBEE
EAGERBEE is a Windows backdoor and malware framework associated with China-nexus espionage activity. It was first publicly reported by Elastic Security Labs in 2023 and later observed by Sophos in updated variants during the Crimson Palace campaign. Reporting links its use to intrusions against a Foreign Affairs Ministry in an ASEAN member state, a high-profile Southeast Asian government organization, and later ISPs and governmental entities in the Middle East. Sophos assessed related campaign activity as Chinese state-directed or Chinese state-sponsored, and separate research assessed EAGERBEE as related with medium confidence to the CoughingDown threat group based on code overlap, shared command structures, and overlapping infrastructure.
EAGERBEE loads additional capabilities using remotely downloaded PE files from command-and-control infrastructure and can execute them in memory. It supports both passive listening and active outbound connection modes, optional SSL/TLS communications via SCHANNEL, and proxy awareness through inspection of Windows Internet Settings. It dynamically constructs its import table at runtime as an anti-analysis measure, creates the mutex mstoolFtip32W, and collects host information including computer name, Windows version details, GUID, processor architecture, ProductName, EditionID, CurrentBuildNumber, and network addressing information. Configuration is stored either in XOR-encoded files such as C:\Users\Public\iconcache.mui or hardcoded in the binary.
Researchers also documented an updated EAGERBEE framework with a service-based injector and plugin architecture. In Middle East intrusions, attackers deployed tsvipsrv.dll with payload file C:\Users\Public\ntusers0.dat and abused the Windows SessionEnv service to inject the backdoor into the Windows Themes service process. The injector replaced the service control handler, triggered execution with SERVICE_CONTROL_INTERROGATE, then restored the original handler and removed stub code. The backdoor was observed as dllloader1x64.dll and, after connecting to C2, received a plugin orchestrator DLL internally named ssss.dll that could receive, load, invoke, unload, and remove plugins from memory.
Documented plugin capabilities include file and directory enumeration and manipulation, ACL changes, file read/write, recursive path enumeration, reflective injection of executables and DLLs, process enumeration and termination, command execution, service creation/start/stop/delete/enumeration, network connection enumeration, and remote access functions. The Remote Access Manager plugin can enable and persist RDP access, download files from URLs, start cmd.exe, inject shell functionality into C:\Windows\System32\dllhost.exe, and relay shell I/O to C2.
Sophos reported updated EAGERBEE variants in Cluster Alpha activity with new capability to blackhole or disrupt communications to antivirus vendor domains inside the victim network. Those variants abused Windows services including IKEEXT and SessionEnv to load malicious DLLs such as wlbsctrl.dll and TSVIPSrv.dll, and installed WinDivert components to intercept DNS traffic and block resolution of domains associated with Microsoft, ESET, McAfee, Trend Micro, Kaspersky, and DrWeb.
Observed infection and deployment vectors include DLL sideloading through legitimate signed applications and service abuse. Elastic linked EAGERBEE to a Mongolia-focused campaign in which a signed Kaspersky application sideloaded a malicious DLL. Separate research tied East Asian EAGERBEE intrusions to exploitation of Microsoft Exchange ProxyLogon (CVE-2021-26855), after which attackers uploaded web shells and executed commands on compromised Exchange servers. Additional observed filenames and artifacts include C:\Users\Public\iconcache.mui, iconcaches.mui, C:\Users\Public\ntusers0.dat, dllloader1x64.dll, tsvipsrv.dll, TSVIPSrv.dll, and the mutex mstoolFtip32W. Reported infrastructure overlaps include C2 IP 185.82.217.164 and hosted-by-bay[.]net-related infrastructure.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Two of these organizations were breached via the infamous ProxyLogon vulnerability (CVE-2021-26855) in Exchange servers, after which malicious webshells were uploaded and utilized to execute commands on the breached servers. | In our recent investigation into the EAGERBEE backdoor, we found that it was being deployed at ISPs and governmental entities in the Middle East.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sophos identified the use of previously unreported malware we call CCoreDoor (concurrently discovered by BitDefender) and PocoProxy, as well as an updated variant of EAGERBEE malware with new capabilities to blackhole communications to anti-virus (AV) vendor domains in the targeted organization’s network.
EAGERBEE is a newly identified backdoor discovered by Elastic Security Labs that loads additional capabilities using remotely-downloaded PE files, hosted in C2.
In our recent investigation into the EAGERBEE backdoor, we found that it was being deployed at ISPs and governmental entities in the Middle East.
Techniques & procedures
37 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
5 techniques
Execution
0x1D (29) Start the command shell (cmd.exe). The module can also run cmd.exe by injecting its code into the process C:\Windows\System32\dllhost.exe. Read data from the command shell and send it to the C2 server.
c:\programdata\microsoft\vmware\vmnat\vmtools\instsrv.exe vmnattools c:\programdata\microsoft\vmware\vmnat\vmtools\srvany.exe
MDR launched the hunt after the discovery of a DLL sideloading technique that exploited VMNat.exe, a VMware component... The Crimson Palace campaign included over 15 distinct DLL sideloading scenarios... Cluster Alpha activity included multiple sideloading attempts to deploy various malware... Cluster Bravo used renamed versions of a signed side-loadable binary (mscorsvw.exe) to obfuscate backdoor deployment.
Persistence
4 techniques
Persistence
It uses a known technique to try to crash EDR processes, by creating a Registry key named SophosFileScanner.exe in the path SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
Two of these organizations were breached via the infamous ProxyLogon vulnerability (CVE-2021-26855) in Exchange servers, after which malicious webshells were uploaded and utilized to execute commands on the breached servers.
Privilege Escalation
4 techniques
Privilege Escalation
Upon establishing a connection to C2, The malware downloads executable files from C2... then extracts the entry point and modifies memory protections to allow execution using the VirtualProtect API. Payload execution in the same process
the registry key additions gave the infected service additional unauthorized privileges. Specifically, the actor invoked a series of token privileges, including SeBackupPrivilege, SeRestorePrivilege, and SeTakeOwnershipPrivilege ... Another invoked privilege was SeTcbPrivilege
Stealth
11 techniques
Stealth
The malware's C2 addresses are either hardcoded values or stored in an XOR-encrypted file named c:\users\public\iconcache.mui . This file is decrypted using the first character as the decryption key.
When we found the backdoor in the infected system, it was named dllloader1x64.dll.
Upon establishing a connection to C2, The malware downloads executable files from C2... then extracts the entry point and modifies memory protections to allow execution using the VirtualProtect API. Payload execution in the same process
change the creation, last access and write time, timestamp of the file to "1/8/2019 9:57"
the registry key additions gave the infected service additional unauthorized privileges. Specifically, the actor invoked a series of token privileges, including SeBackupPrivilege, SeRestorePrivilege, and SeTakeOwnershipPrivilege ... Another invoked privilege was SeTcbPrivilege
the HUI loader (msedge_elf.dll), which de-obfuscated the file log.ini to reveal a Cobalt Strike reflective Loader
attrib . exe + s + h + a C : \ users \ public \ ntusers0 . dat ... attrib . exe + s + h + a system32 \ tsvipsrv . dll
MDR launched the hunt after the discovery of a DLL sideloading technique that exploited VMNat.exe, a VMware component... The Crimson Palace campaign included over 15 distinct DLL sideloading scenarios... Cluster Alpha activity included multiple sideloading attempts to deploy various malware... Cluster Bravo used renamed versions of a signed side-loadable binary (mscorsvw.exe) to obfuscate backdoor deployment.
The attackers abused the legitimate Windows services MSDTC, IKEEXT and SessionEnv to execute malicious DLLs: oci.dll, wlbsctrl.dll and TSVIPSrv.dll, respectively.
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Discovery
6 techniques
Discovery
The backdoor retrieves the proxy host and port information for the current user by reading the registry key Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer.
The module also collects user accounts associated with the processes.
Network Manager This plugin lists the network connections in the system... Get information about the list of IPv4 and IPv6 TCP and UDP connections
It then collects details about all running processes on the system, including: Process identifiers; The number of execution threads started by each process; The identifier of the parent process; The fully qualified path of each process executable.
The malware gathers key information about the compromised system: The computer's name is obtained using the GetComputerNameW function... The processor architecture information is acquired using the GetNativeSystemInfo function... The ProductName, EditionID, and CurrentBuildNumber are extracted from the designated registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion
Lateral Movement
2 techniques
Lateral Movement
Collection
1 technique
Collection
Command and Control
6 techniques
Command and Control
the overall goal behind the campaign was to maintain access to the target network for cyberespionage... deploying various malware implants for command-and control (C2) communications... Use of multiple persistent C2 channels including Merlin Agent, PhantomNet backdoor, RUDEBIRD malware, EAGERBEE malware, and PowHeartBeat backdoor... Deployment of several samples of... PocoProxy for persistent C2 communications.
0x0D (13) Download a file from the specified URL and write to the specified file path.
Dormant C2 communications via DNS requests and TCP network connections continued for approximately two days.
The malware has the capability to detect the presence of an HTTP proxy configuration on the host machine by inspecting the ProxyEnable registry key within Software\Microsoft\windows\CurrentVersion\Internet Settings . If this key value is set to 1 , the malware extracts the information in the ProxyServer key.
Upon establishing a connection to C2, The malware downloads executable files from C2, likely pushed automatically. It validates that each executable is 64bit, then extracts the entry point and modifies memory protections to allow execution using the VirtualProtect API.
Exfiltration
1 technique
Exfiltration
Impact
1 technique
Impact
Other
1 technique
Other
High prioritization of evasive tactics and tools: ... overwriting ntdll.dll in memory to unhook the Sophos AV agent process from the kernel, abusing AV software for sideloading... Deployment of new EAGERBEE malware variants with updated capability of modifying packets to disrupt security agent network communications.
IOCs tracked for this family
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor framework with modular components for payload deployment, filesystem enumeration, and command execution; updated variant targeting ISPs and government entities in the Middle East.
A modular backdoor framework used to compromise targets, execute commands, enumerate file systems, and deploy additional payloads.
A Chinese-nexus malware family whose newer variants were used to infect services, establish C2, and modify DNS traffic via WinDivert to block communications with security vendor infrastructure.
Referenced as malware previously seen in related Cluster Alpha activity that could potentially be used to block endpoint telemetry and updates.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.