China-Linked Hackers Target Edge Routers with Custom Linux Malware

Key Takeaways

• A sophisticated, China-linked threat actor is actively compromising edge routers and Windows systems across Southeast Asia.
• The campaign utilizes a custom Linux implant, “router.elf,” on network devices and a Cobalt Strike Beacon on Windows endpoints, both operating under a unified command-and-control infrastructure.
• Attackers gain extensive control over network traffic by redirecting DNS queries and manipulating web access, posing a critical risk to affected organizations.
• The operation exhibits clear indicators of Chinese origin, including language strings and specific tool usage patterns.

China-Linked Group Deploys Custom Linux Malware on Edge Routers, Targets Windows Systems in Coordinated Southeast Asian Campaign

A highly organized, state-backed hacking group, believed to originate from China, is orchestrating a critical cyber espionage campaign across Southeast Asia. This operation involves the simultaneous compromise of edge routers and Windows-based computers within targeted networks, deploying custom-built Linux malware to achieve deep and persistent control over network traffic and internal systems.

The attackers install a malicious Linux executable, identified as router.elf, directly onto border routers. This implant transforms these crucial network devices into covert surveillance and manipulation platforms. The severity of this campaign is rated as critical, given its ability to extend control far beyond the initial compromised device, effectively weaponizing the network infrastructure itself.

Once established, the implant communicates with attacker-controlled servers via an encrypted channel, making detection by conventional security measures exceptionally challenging. This stealthy approach is designed to evade endpoint security solutions and maintain a low profile throughout the operation.

Analysts at Qiita, who first identified this sophisticated intrusion, highlighted the strategic shift towards targeting network infrastructure rather than individual hosts. By compromising routers, the threat actor gains a vantage point to monitor and manipulate all devices connected through them, a capability far more dangerous than typical malware infections. “By owning the router, the attackers position themselves to monitor and manipulate every device that connects through it,” Qiita noted in their report. “That makes this threat far more dangerous than a typical malware infection.”

Dual-Pronged Attack Leverages Router and Endpoint Exploitation

Adding to the alarm, the same threat group also deployed a separate hacking tool on Windows computers within the same compromised networks. This was achieved using a technique known as DLL sideloading. Both the Linux router implant and the Windows endpoint tool share a common command and control (C2) infrastructure, confirming that a single, coordinated threat actor is behind this extensive espionage effort.

Multiple forensic clues strongly indicate a China-based origin for this campaign. These include Mandarin language strings embedded within the implant’s code, a hardcoded language setting of “zh-CN” in its communication profile, and the use of a cracked hacking tool whose license ID has been consistently linked to previous China-linked operations. Qiita shared these findings in a report with Cyber Security News (CSN), solidifying the attribution.

How the Implant Takes Over Edge Routers

Upon successful installation, router.elf establishes a persistent, encrypted HTTPS connection on port 443 to its C2 servers. To further evade detection, it leverages Cloudflare’s DNS over HTTPS (DoH) service for domain lookups, disguising these requests as normal web traffic and enabling prolonged stealth.

The malware also manipulates the router’s firewall rules using the built-in Linux tool iptables. These rules silently redirect all DNS queries from devices behind the router to attacker-controlled servers. This allows the hackers to falsify website destinations, intercept software updates, and target specific network destinations using a dynamic list named evil_fix. A secondary backdoor, client_rc_start, is installed to ensure continued access, even if the primary router.elf payload is neutralized.

Windows Endpoints Caught in the Crossfire

Beyond the network perimeter, the threat group extended its reach to internal Windows machines. They deployed a Cobalt Strike Beacon, a prevalent post-exploitation framework, through a DLL sideloading technique. A malicious file, version.dll, is placed within a folder associated with CrashReport.exe. When the legitimate CrashReport.exe process executes, it inadvertently loads the attacker’s malicious DLL, granting the threat actor control over the Windows system.

The Cobalt Strike Beacon communicates with the same C2 domains as the router implant, exhibiting identical web traffic patterns, cookie markers (_UK= for GET requests, _ZF= for POST requests), and a consistent 50-second sleep interval between check-ins. This strong operational overlap confirms that both the router and Windows compromises are part of a unified, coordinated espionage campaign.

What You Should Do

• Immediate Router Audit: Scrutinize all edge routers for unauthorized firewall rules, particularly those redirecting DNS traffic to suspicious IP addresses.
• Perimeter Blocking: Immediately block all identified C2 domains and IP addresses at your perimeter firewall.
• System Scans: Scan Linux-based network devices for the presence of router.elf and client_rc_start. On Windows machines, check for the malicious version.dll and any CrashReport.exe processes running from the AllUsers profile folder.
• Firmware Integrity: Implement firmware integrity monitoring on all network devices.
• Access Control: Restrict management access to network devices and enforce multi-factor authentication (MFA).
• Alerting: Configure alerts for any unauthorized changes to firewall rules on routers and gateways.

Indicators of Compromise (IoCs):

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.