CrimsonIAS Backdoor

The CrimsonIAS Backdoor is a threatening piece of malware that first emerged in 2017. The CrimsonIAS Backdoorwas involved in attacks against targets in Mongolia, Vietnam and Hong Kong. The criminals behind this project are believed to be an Advanced Persistent Threat (APT) group tracked under the alias Mustang Panda or Bronze President. The group's members are believed to originate from China, which is not a surprise considering the profile of CrimsonIAS Backdoor's targets.

The CrimsonIAS Backdoor was coded in Delphi, and it packs the typical features for Trojan backdoors. The CrimsonIAS Backdoor enables its operators to run remote commands, collect files and upload files to the infected system. The implant also is able to avoid systems used for malware analysis by checking for the presence of specific drivers and properties linked to virtual environments.

The CrimsonIAS Backdoor has been a part of Mustang Panda's toolset for over three years, and the malware has been updated during this period regularly. This particular threat is unlikely to be employed in attacks against regular computer users – its operators are only interested in political movements and non-government organizations in the aforementioned countries.