CROSSWALK

Aliases: Motnug, ProxIP, TOMMYGUN

First seen
2016-01-01 00:00:00
Malware type
backdoor
Family
Malware family
Profile updated
2026-07-07 13:04:05

Targeted industries: government-and-public-sector technology-and-telecommunications

Targeted regions: country_code:us country_code:cn

Context

According to FireEye, CROSSWALK is a skeletal, modular backdoor capable of system survey and adding modules in response to C&C replies.

Detection coverage

  • 1 YARA rules

Detection rules

  • MALPEDIA_Win_Crosswalk_Auto (yara-rule)

Reports & references

  • i.blackhat.com — As 22 Leonsilvia Nextgenplugxshadowpad (report)
  • ESET — Sidewalk May Be As Dangerous As Crosswalk (report)
  • ESET — Eset Threat Report Q22020 (report)
  • virusbulletin.com — Down The Grayrabbit Hole Exposing Unc3569 And Its Modus Operandi (report)
  • Kaspersky — 99204 (report)
  • youtube.com — Watch (report)
  • Mandiant — Rpt Apt41 (report)
  • ptsecurity.com — Higaisa Or Winnti Apt 41 Backdoors Old And New (report)
  • Trend Micro — Earth Baku Returns (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Crosswalk (report)
  • carbonblack.com — Cb Tau Threat Intelligence Notification State Sponsored Espionage Group Targeting Multiple Verticals With Crosswalk (report)
  • Broadcom/Symantec — Grayfly China Sidewalk Malware (report)
  • Broadcom/Symantec — Apt41 Indictments China Espionage (report)
  • youtube.com — Watch (report)
  • thehackernews.com — Researchers Disclose Undocumented (report)
  • carbonblack.com — Cb Threat Analysis Unit Technical Analysis Of Crosswalk (report)
  • twitter.com — 1159459082534825986 (report)

External references