Lunghi Iron Tiger Linux

SysUpdate can collect information and files from a compromised host.

SysUpdate can collect a list of services on a victim machine.

SysUpdate can collected the IP address and domain name of a compromised host.

SysUpdate can contact the DNS server operated by Google as part of its C2 establishment process.

SysUpdate has been packed with VMProtect.

SysUpdate can collect the username from a compromised host.

SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.

SysUpdate has exfiltrated data over its C2 channel.

SysUpdate can collect information about running processes.

SysUpdate has used DNS TXT requests as for its C2 communication.

SysUpdate can collect a system's architecture, operating system version, and hostname.

SysUpdate can search files on a compromised host.

SysUpdate has the ability to download files to a compromised host.

SysUpdate can call the `GetNetworkParams` API as part of its C2 establishment process.

SysUpdate has used Base64 to encode its C2 traffic.

SysUpdate can copy a script to the user owned `/usr/lib/systemd/system/` directory with a symlink mapped to a `root` owned directory, `/etc/ystem/system`, in the unit configuration file's `ExecStart` directive to establish persistence and elevate privileges.

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.

Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.

SysUpdate has been signed with stolen digital certificates.

SysUpdate has used DES to encrypt all C2 communications.

Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.

Threat Group-3390 has registered domains for C2.

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.

SysUpdate can collect a system's drive information.