The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT
summary
Pangolin8RAT emerges mid‑2020 as a modular RAT that downloads modular plugins (DLLs) from C2, keeps key components as memory-only modules, and expands communication to multiple protocols including KCP protocol and HTTP. Installer embeds encrypted resources, decrypts by checksum, and uses local callback injection, layered persistence and kernel exploit escalation; researchers link campaigns to a group labeled Tianwu targeting gambling, telecom and transport in APAC (including Kazakhstan), show code reuse with FFL/Winq families, and demonstrate the toolkit is active and evolving.
AI-written summary · about
chapters (12)
- 0:00Start
- 1:12Outline
- 9:23Resource format
- 10:23Module Decryption Procedure
- 18:14Code similarity with FFRAT and Winnti 2.0
- 21:49Phantom DLL hollowing
- 22:10TTPs overlap with Amoeba malware family
- 28:27Target Industry and Region
- 30:24Case Study
- 35:55Threat Landscape: New APT Operation Mode
- 37:05Conclusion and Outlook
- 38:36Countermeasures
related talks
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
17mRadRAT: An all-in-one toolkit for complex espionage ops
31mHacking People’s Mind: When Threat Actors Master Social Engineering
49mxRAT
42mMac-ing Sense of the 3CX Supply Chain Attack: Analysis of the macOS Payloads
19mOperation PZCHAO
18mSchrödinger’s RAT: Profiling Stakeholders in the Remote Access Trojan Ecosystem
10mSurfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops