SManager
Aliases: PhantomNet
- First seen
- 2020-05-15 00:00:00
- Malware type
- rat, spyware
- Family
- Malware family
- Profile updated
- 2026-07-07 12:56:37
Targeted industries: government-and-public-sector
Targeted regions: country_code:us country_code:cn
Context
SManager, also known as PhantomNet, is a remote access tool used for espionage activities. It is primarily involved in data exfiltration and provides attackers with the ability to persistently control infected systems.
Detection coverage
- 2 YARA rules
Detection rules
- SEKOIA_Apt_Backdoordiplomaty_Phantomnet (yara-rule)
- MALPEDIA_Win_Smanager_Auto (yara-rule)
Reports & references
- blog.group-ib.com — Task (report)
- elastic.co — Introducing The Ref5961 Intrusion Set (report)
- Trend Micro — Ssl Tls Technical Brief (report)
- insight-jp.nttsecurity.com — Pandas New Arsenal Part 3 Smanager (report)
- labs.sentinelone.com — Thundercats Hack The Fsb Your Taxes Didnt Pay For This Op (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Smanager (report)
- blog.vincss.net — Re018 2 Analyzing New Malware Of China Panda Hacker Group Used To Attack Supply Chain Against Vietnam Government Certification Authority (report)
- blog.vincss.net — Phan Tich Ky Thuat Dong Ma Doc Moi Co Nhieu Dau Hieu Lien Quan Toi Nhom Tin Tac Panda (report)
- 0xthreatintel.medium.com — Reversing Apt Tool Smanager Unpacked D413A04961C4 (report)
- blog.vincss.net — Re017 2 Phan Tich Ky Thuat Dong Ma Doc Moi Co Nhieu Dau Hieu Lien Quan Toi Nhom Tin Tac Panda (report)
- 0xthreatintel.medium.com — How To Unpack Smanager Apt Tool Cb5909819214 (report)
- ESET — Operation Signsight Supply Chain Attack Southeast Asia (report)
- blog.vincss.net — Re020 Elephantrat Kunming Version Our Latest Discovered Rat Of Panda (report)
- blog.vincss.net — Re018 1 Analyzing New Malware Of China Panda Hacker Group Used To Attack Supply Chain Against Vietnam Government Certification Authority (report)