Sword2033

Sword2033 is a new and previously undocumented backdoor tool used by the China-linked threat actor known as Alloy Taurus. This group, also referred to as GALLIUM or Softcell, has been actively targeting Linux systems with a variant of the PingPull backdoor, while also deploying Sword2033 in their operations. The use of Sword2033 was first identified by researchers from Palo Alto Networks' Unit 42 in April 2023, during their investigation into the infrastructure leveraged by Alloy Taurus for the PingPull Linux variant. The Sword2033 backdoor is relatively simple in its functionality but effective in its purpose. It supports three basic functions: uploading files to the system, downloading files from the system, and executing commands. The analysis of the C2 domain yrhsywu2009.zapto[.]org, found in both the PingPull Linux variant and the first Sword2033 sample, shows that it was most recently hosted on 5.181.25[.]99 until early February 2023. Alloy Taurus continues to pose a significant threat to telecommunications, finance, and government organizations across Southeast Asia, Europe, and Africa. The identification of a Linux variant of the PingPull malware, along with the recent use of the Sword2033 backdoor, suggests that this group is continuously evolving their operations in support of their espionage activities. As such, cybersecurity measures must be enhanced to counteract these sophisticated threats.