EAGLEDOOR (Backdoor) – Malware

Overview

EAGLEDOOR is a sophisticated backdoor malware identified as part of advanced cyber-espionage campaigns targeting critical infrastructure, government agencies, and businesses across the Asia-Pacific region. Discovered in 2024, the malware has been attributed to the threat group Earth Baxia, which is believed to be operating out of China. EAGLEDOOR’s main purpose is to facilitate long-term, undetected access to compromised systems, enabling attackers to conduct extensive surveillance, exfiltrate sensitive data, and deploy additional payloads to further the group’s objectives.

What sets EAGLEDOOR apart from many other malware families is its advanced evasion techniques and modular design. It employs DLL side-loading, allowing malicious code to run within legitimate processes, significantly reducing the likelihood of detection by traditional security measures. By using encrypted payloads and leveraging legitimate system APIs, EAGLEDOOR is able to maintain persistence and adapt to the target environment, making it a versatile tool for cyber-espionage operations.

Targets

Public Administration

How they operate

Infection and Initial Access

EAGLEDOOR typically gains initial access to target systems through spear-phishing emails or exploiting vulnerabilities in widely used software. In the case of spear-phishing, attackers craft carefully targeted messages that often contain malicious attachments or links. Upon execution, these attachments initiate the infection chain. For instance, the malware can arrive as a dropper or downloader disguised as a legitimate file, which, once opened, triggers the download of additional malicious components. This first stage often includes the use of widely recognized exploitation techniques, including DLL side-loading, where malicious code is injected into legitimate processes, making detection harder.

Once the malware has infiltrated the system, it sets up its base by leveraging vulnerabilities in the victim’s environment. For example, the malware may exploit remote code execution (RCE) vulnerabilities or use public cloud infrastructure to stage additional payloads. These payloads can include further exploit code or configuration files that instruct the malware on how to proceed with its operations, including communication with a command-and-control (C&C) server for remote instructions.

Persistence Mechanisms

EAGLEDOOR’s persistence strategy is complex and robust, ensuring that the malware can stay active within compromised systems for extended periods without detection. One of its primary techniques is the use of DLL side-loading. This allows EAGLEDOOR to inject malicious code into trusted, running processes. The side-loaded DLL is typically encrypted within the malware’s data section and only decrypted once it is loaded into memory. The loader component of EAGLEDOOR, which can be identified as “Systemsetting.dll,” is responsible for executing these malicious routines in memory, without touching the disk in a manner that would easily trigger antivirus defenses.

Additionally, the malware utilizes API hooking, a method where malicious code intercepts the function calls of legitimate applications. This technique is particularly effective in evading detection because the malware can hijack system calls and execute its payloads without triggering alarms. The malicious payload “Eagle.dll” is executed when specific API functions are called, allowing the attackers to gain further control over the victim’s system and maintain access even when defensive measures are applied.

Data Exfiltration and Communication

Once installed, EAGLEDOOR’s primary function is to collect data from the infected machine. It can gather system information such as usernames, computer names, and network configurations, which it then sends back to a remote server under the attacker’s control. The malware supports multiple communication protocols, which makes it adaptable to different environments. It can use HTTP, HTTPS, and even custom protocols to communicate with its C&C servers, ensuring it can bypass firewalls and network monitoring systems. The stolen information is typically exfiltrated in small chunks to avoid detection, making it harder for network administrators to spot large-scale data theft.

EAGLEDOOR’s communication also includes the use of encrypted channels. It employs secure and sometimes obfuscated communication to ensure that all data exchanges between the malware and the C&C server remain hidden from traditional monitoring tools. The malware’s ability to disguise its communication channels as legitimate network traffic further complicates efforts to track its activities.

Payload Deployment and Further Exploitation

Another key feature of EAGLEDOOR is its ability to deploy additional payloads as part of a multi-stage attack. After initial access is gained, the malware can download and execute additional payloads, such as remote access tools (RATs) or file exfiltration utilities, depending on the attacker’s objectives. These payloads can also be downloaded from cloud services, ensuring that attackers can quickly adapt and change their approach without having to modify the malware itself. The use of cloud services to stage payloads provides a flexible infrastructure that makes it difficult to trace the malware’s origin and update mechanism.

The deployment of these additional tools is typically done in an automated fashion. EAGLEDOOR may schedule tasks or set up specific triggers within the victim’s environment to ensure that the malware remains active and continues to fulfill its espionage role. This modular approach allows EAGLEDOOR to be highly adaptable, capable of carrying out a range of activities from information gathering to complete system compromise.

Evasion and Anti-Detection Techniques

EAGLEDOOR employs multiple techniques to evade detection by security solutions. As mentioned earlier, the use of DLL side-loading and API hooking allows the malware to execute without triggering traditional endpoint protection systems. Furthermore, EAGLEDOOR’s communication with C&C servers is encrypted and uses disguised domain names, often resembling legitimate cloud service providers such as Amazon Web Services (AWS) or Alibaba Cloud, which further reduces the chances of being flagged by network security tools.

In addition, EAGLEDOOR’s use of memory-based execution means that many of its payloads never touch the disk, making it harder for traditional file-based antivirus software to detect the malware. The malware’s payloads are typically encrypted and decrypted in memory, meaning that even if a system’s file system is scanned, the malicious code may remain undetected.

Conclusion

EAGLEDOOR represents a significant evolution in cyber-espionage tactics, combining advanced persistence techniques, multi-stage payload delivery, and flexible communication protocols. Its modular nature, ability to evade detection, and sophisticated data exfiltration capabilities make it a formidable tool in the arsenal of cyber threat actors. Understanding the technical aspects of EAGLEDOOR is critical for organizations, especially in the Asia-Pacific region, as it highlights the growing risks posed by advanced persistent threats (APTs) targeting critical infrastructure and sensitive data. The use of sophisticated tools like EAGLEDOOR underscores the need for robust cybersecurity strategies that can detect, respond to, and mitigate the impact of these increasingly complex threats.

References

• Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC