Trend Micro researchers uncover Void Arachne, a new threat actor targeting Chinese-speaking users with malicious MSI installers that bundle the Winos 4.0 backdoor. The campaign relies on SEO poisoning and Telegram/social channels to distribute backdoored installers, while promoting nudifier/deepfake AI tools and VPN content to exploit interest in evading online censorship, potentially leading to full system compromise. #VoidArachne #Winos4_0
Keypoints
- Void Arachne is a newly identified threat actor targeting Chinese-speaking users with MSI installers that bundle Winos 4.0 backdoor payloads.
- The campaign distributes malicious MSI files via SEO-poisoned infrastructure and attacker-controlled Telegram channels and other social media.
- The MSI bundles include nudifiers and AI-based deepfake/face- and voice-swapping tools, along with zh-CN language packs and VPNs marketed to Chinese users.
- Winos 4.0 is a modular backdoor with a stager, plugins, and C&C infrastructure, capable of device control, keylogging, screen capture, and more.
- Persistence and defense-evading techniques include VBScript-based scheduled tasks, Windows services, port forwarding, firewall rule manipulation, and anti-analysis checks.
- IoCs include specific MSI file hashes, domain infrastructure (webcamcn.xyz), and VPN-related distribution channels and artifacts.
- The campaign highlights risks around MSI-based software delivery and the use of AI-enabled tools for deception and cybercrime.
MITRE Techniques
- [T1608.006] SEO poisoning – “SEO poisoning … infrastructure staged for SEO poisoning and malicious package distribution across Chinese-language-themed Telegram channels.” –
- [T1566.002] Spearphishing Link – “spear-phishing links disguised as legitimate software installers to lure potential victims.” –
- [T1053.005] Scheduled Task – “VBScript designed to automate the creation of a scheduled task within Windows Task Scheduler to achieve persistence.” –
- [T1543.003] Create/Modify Windows Service – “The malware creates a Windows service that starts with CreateSvc_ to execute the VBScript file.” –
- [T1140] Deobfuscate/Decode Files or Information – “The loader uses the Rivest Cipher 4 (RC4) algorithm with the key … to decrypt this data.” –
- [T1055] Process Injection – “Winos … supports … process injection …” –
- [T1497] Virtualization/Sandbox Evasion – “anti-analysis feature … verifies the presence of monitoring software by inspecting the window titles of running processes. If such software is detected, the malware enters sleep mode.” –
- [T1113] Screen Capture – “screen capturing” capabilities embedded in Winos 4.0. –
- [T1056.001] Keylogging – “keyboard recording” and related keylogging functionalities. –
- [T1082] System Information Discovery – the malware collects system information (IP, computer name, antivirus, OS, HWID). –
Indicators of Compromise
- [File/Hash] Letvpn.msi – fae4f96beda54a1ed4914537b0542182d3a020dd9db9d9995df37d303b88e6df, size 27.05 MB – MSI installer used in the campaign.
- [File/Hash] LetsPRO.exe (Loader) – FE7AEDAB70A5A58EFB84E6CB988D67A4, size 40 KB – Loader component; listed in the MSI drop.
- [File/Hash] LetsPRO.exe – 7BB188DFEE179CBDE884A0E7D127B074, size 247 KB – Secondary loader in the chain.
- [Domain] webcamcn.xyz – domain used as C2 infrastructure; subdomains appear in the campaign (e.g., 103.214.147.14.webcamcn.xyz).
- [IP] 103.214.147.14 – C2-related address used in the stager configuration.
- [IP] 127.0.0.1 – used in stager configuration as a local address in its configuration block.
- [URL] webcamcn.xyz/* subdomains referenced in C2 configuration.
- [Y/N] 103.214.147.14.webcamcn.xyz – embedded C2 address in the stager’s network configuration.