Confucius Hackers Attacking Government & Military Entities With wooperstealer

The notorious Confucius hacking organization has unveiled a sophisticated new cyber weapon targeting government and military entities across South Asia and East Asia, according to recent intelligence reports.

This advanced persistent threat group, first identified in 2016 with attack activities tracing back to 2013, has significantly evolved its malware arsenal with the introduction of a componentized backdoor system dubbed “anondoor.”

The latest campaign represents a marked escalation in the group’s technical capabilities, transforming their previously simple downloader trojans into a modular backdoor framework that dynamically loads malicious components from command-and-control servers.

The attack chain begins with a weaponized LNK file that downloads multiple components, including the core anondoor backdoor disguised as python313.dll and a legitimate Python executable serving as a decoy loader.

Seebug researchers noted that the malware’s architecture demonstrates unprecedented sophistication in its evasion techniques, utilizing a parameterized command-and-control communication mechanism that obscures the true infrastructure from security analysts.

The componentized design allows attackers to selectively deploy specific capabilities based on target requirements, including the wooperstealer data exfiltration module that has been integrated as a downloadable component rather than a standalone executable.

The malware establishes persistence through Windows scheduled tasks, creating a task named “SystemCheck” that ensures continuous execution across system reboots.

Intelligence agencies have observed active campaigns targeting critical infrastructure and defense organizations, with the malware’s modular nature enabling customized attacks against high-value targets while maintaining operational security through distributed component hosting.

Current antivirus detection rates remain effectively zero due to the malware’s sophisticated sandbox evasion mechanisms and dynamic loading architecture, presenting significant challenges for traditional security solutions.

The componentized approach allows the Confucius group to maintain persistent access while minimizing their digital footprint and complicating attribution efforts by security researchers.

Dynamic Component Loading and Communication Protocol

The anondoor backdoor implements a sophisticated component orchestration system that fundamentally changes how the malware operates compared to traditional monolithic threats.

The system employs a unique UUID generation algorithm that combines hardware fingerprinting with system information to create persistent victim identification across infections.

The malware generates this identifier using ACPI table data, hostname, and username through a custom hashing function:-

public static string GetUUID()
{
    string text = RetrieveAndPrintUUID();
    string input = GetComputerName() + "{" + text + "}" + GetCurrentUserName();
    return Hashuuid(input).ToString();
}

The communication protocol utilizes base64-encoded requests containing victim UUID and control commands, with the server responding with component download URLs and execution instructions formatted as delimited strings.

This architecture enables the Confucius group to maintain granular control over deployed capabilities while significantly complicating forensic analysis and network-based detection efforts.

Are you from SOC/DFIR Teams! - Interact with malware in the sandbox and find related IOCs. - Request 14-day free trial