EggStreme: New Fileless Malware from a Chinese APT Targets Philippine Military

EggStreme is described by Bitdefender Threat researchers as a modular, multi‑stage fileless malware framework used by a Chinese APT to compromise a Philippine military company. The campaign was first detected in early 2024, and the framework operates by injecting malicious code into memory and using DLL sideloading to run payloads, enabling persistent, low‑profile espionage.

The attack chain starts with EggStremeFuel, a malicious DLL sideloaded by a legitimate executable, then delivers EggStremeLoader, which decrypts additional payloads, followed by EggStremeReflectiveLoader and the final core implant EggStremeAgent, injected into trusted processes such as winlogon.exe or explorer.exe.

EggStremeAgent functions as the backdoor’s central nervous system, capable of 58 distinct commands including system reconnaissance, arbitrary command execution, lateral movement and data exfiltration, while the framework also deploys EggStremeWizard and EggStremeKeylogger to harvest keystrokes and other sensitive data.

The operators further rely on the Stowaway proxy tool to bypass network segmentation, and the whole ecosystem is designed to be highly stealthy, with ongoing emphasis on living‑off‑the‑land binaries to blend in with legitimate activity.