Let's go door with KCP
Excerpt
LONDON
2023
LET’S GO DOOR WITH KCP
Yoshihiro Ishikawa & Takuma Matsumoto
LAC Cyber Emergency Center, Japan
yoshihiro.ishikawa@lac.co.jp
takuma.matsumoto@lac.co.jp
4 - 6 October, 2023 / London, United Kingdom
www.virusbulletin.com
LET’S GO DOOR WITH KCP ISHIKAWA & MATSUMOTO
2 VIRUS BULLETIN CONFERENCE OCTOBER 2023
ABSTRACT
In 2022 we observed the use of new APT malware by an unknown China-based APT actor across several incidents in Japan. The malware uses KCP protocol for backdoor communication and was coded in Golang on multiple platform operating systems – we named it ‘gokcpdoor’.
This backdoor has 20 commands and connects with C2 servers via KCP over UDP. KCP is a communication protocol that maximizes bandwidth for reliable, low-latency communicati…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Virus Bulletin on virusbulletin.com.
More from Virus Bulletin10
- Google-Calendar-as-C2-infrastructure-a-China-nexus-campaign-with-stealthy-tactics.pdfVirus Bulletin · Added 24 Mar
- Down-the-GRAYRABBIT-hole-exposing-UNC3569-and-its-modus-operandi.pdfVirus Bulletin · Added 29 Jan
- DeceptiveDevelopment-and-North-Korean-IT-workers-from-primitive-crypto-theft-to-sophisticated-AI-based-deception.pdfVirus Bulletin · Added 16 Oct 2025
- Sugarcoating-KANDYKORN-a-sweet-dive-into-a-sophisticated-MacOS-backdoor.pdfVirus Bulletin · Added 15 Jan 2025
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
