Elirks
- First seen
- 2010-01-01 00:00:00
- Malware type
- backdoor, trojan
- Family
- Malware family
- Profile updated
- 2026-07-07 14:59:43
Targeted industries: government-and-public-sector technology-and-telecommunications
Targeted regions: country_code:jp country_code:cn
Context
Elirks is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems. Mostly attacks using Elirks occurring in East Asia. One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor. Multiple Elirks variants using Japanese blog services for the last couple of years.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Elirks_Auto (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Elirks (report)
- researchcenter.paloaltonetworks.com — Mile Tea Cyber Espionage Campaign Targets Asia Pacific Businesses And Government Agencies (report)
- Palo Alto Unit 42 — Unit42 Tracking Elirks Variants In Japan Similarities To Previous Attacks (report)