China-aligned hackers have deployed a Linux-based ELF backdoor to steal cloud credentials at scale from workloads across AWS, GCP, Azure, and Alibaba Cloud environments.

According to Breakglass Intelligence findings, the backdoor uses a “zero-detection” technique, employing SMTP port 25 as a covert command-and-control (C2) channel to harvest cloud provider credentials and metadata.

“A selective C2 handshake validation mechanism renders the server invisible to conventional scanning tools like Shodan and Censys,” Breakglass researchers said in a blog post. Stolen credentials are sent to three Alibaba-themed typosquatted domains hosted on Alibaba Cloud infrastructure in Singapore.

The campaign, attributed to the known APT41 (Winnti) group, targets sensitive cloud credentials, including IAM role credentials, service account tokens, managed identity tokens, and RAM role credentials.

Metadata made into the new password

Once executed, the malware queries the instance metadata service, commonly exposed at 169.254.169.254, to retrieve access tokens and configuration data belonging to the host environment.

Queries vary depending on the environment. For AWS, they are made for IAM role credentials, for service account tokens in GCP, managed identity tokens from IMDS endpoints on Azure, and for RAM role credentials from ECS metadata in Alibaba Cloud.

The researchers also pointed out a lateral movement beacon in the form of a UDP broadcast. “The implant periodically sends UDP broadcast packets to ‘255.255.255.255:6006’ within the local network segment,” they said. “These broadcasts contain an encoded beacon that other compromised hosts can receive, enabling peer-to-peer coordination and lateral tasking distribution without additional C2 traffic.”

Researchers trace the Winnti activities back to 2020, making it a 6-year-old campaign, with the first documented variant “PWNLNX” using basic reverse shell and XOR encoding. Things have changed a lot since then.

Typosquatting for cloud-native espionage

The campaign relies heavily on deception, the researchers pointed out, using C2 domains closely resembling legitimate Alibaba Cloud services. The typosquatting approach allows malicious traffic to blend into routine cloud operations, specifically in environments where outbound filtering is absent.

The implant used is an obfuscated ELF binary, with an executable designed for gaining and maintaining access within Linux cloud instances. The researchers said that the binary was not detected at all on ViruTotal at the time of analysis, supporting their “zero-detection” claims.

The malware also does not respond to unintentional probes, with the C2 infrastructure remaining silent unless a correct (malicious) handshake is established. This throws off automated scanning and sandboxing.

Additionally, communication over SMTP (port 25) adds a layer of stealth. While conventional C2 traffic sticks to HTTP/S, SMTP is used here to blend into legacy or misconfigured environments where Port 25 traffic is expected. “Many cloud security tools do not deeply inspect SMTP traffic for C2 patterns,“ the researchers noted. “Egress filtering on port 25 is inconsistent across cloud providers.”

Indicators and detection

Despite the use of stealth, the researchers were able to connect the dots with the help of independent research by @Xlab_qax, who attributed the campaign and its lineage to APT41 with high confidence. Indicators shared by the researchers include files and network signatures (domain and ports). They also included a list of MITRE ATT&CK tactics for a broader understanding of the years-long campaign. Breakglass disclosure pointed to a behavior-driven detection approach across layers.