Chinese APT Deploys EggStreme Fileless Malware to Breach Philippine Military Systems

An advanced persistent threat (APT) group from China has been attributed to the compromise of a Philippines-based military company using a previously undocumented fileless malware framework called EggStreme.

According to Bitdefender, EggStreme is a tightly integrated, multi-component toolkit that achieves persistent, low-profile espionage by injecting code into memory and using DLL sideloading to run payloads, with EggStremeAgent described as a full-featured backdoor enabling system reconnaissance, lateral movement and data theft via a keylogger.

The operation begins with a payload named EggStremeFuel (mscorsvc.dll) that deploys EggStremeLoader to establish persistence, then EggStremeReflectiveLoader, which triggers EggStremeAgent. The framework supports 58 commands for local and network discovery, shellcode execution, privilege escalation, data exfiltration and includes an auxiliary implant called EggStremeWizard (xwizards.dll); it also uses Stowaway to forge an internal foothold and relies on in-memory execution to avoid leaving traces on disk.

The report notes that the attackers sideload a legitimate binary to load the malicious DLL, a technique Bitdefender says is consistently abused across the attack chain. The piece was published on 10 September 2025.