A sophisticated variant of the EAGERBEE (Thumtais) malware framework has emerged, targeting Internet Service Providers and government entities across the Middle East. Kaspersky researchers have identified significant enhancements in the malware’s capabilities, including new components for payload deployment, file system enumeration, and command shell execution.

Key Features and Functionality:
– Plugin-based architecture with six main components:
* Plugin Orchestrator
* File System Manipulation
* Remote Access Management
* Process Exploration
* Network Connection Listing
* Service Management

Attribution and History:
The malware is attributed to the CoughingDown threat group and was initially documented by Elastic Security Labs as a state-sponsored tool (REF5961). Chinese state-aligned actors, including Cluster Alpha, have previously utilized EAGERBEE variants in operations like Crimson Palace, targeting military and political assets in Southeast Asia.

Technical Implementation:
– Memory-resident architecture for enhanced stealth
– Injector DLL for backdoor deployment
– TCP socket-based command and control
– System information collection and exfiltration
– ProxyLogon vulnerability (CVE-2021-26855) exploitation in East Asian targets

The malware’s sophisticated memory-resident design and process injection capabilities make it particularly challenging to detect using conventional security solutions. Recent attacks demonstrate its continued evolution and effectiveness in cyber espionage operations.