Red_Nue__2022__WinDealer_dealing_on_the_side_Securelist.pdf

This Kaspersky GReAT report examines LuoYu’s WinDealer — a modular Windows backdoor deployed via compromised auto-update flows and likely man-on-the-side interception — detailing its functionality, unusual C2 IP-generation and protocol, delivery mechanics, and providing multiple file-hash indicators; the authors conclude the actor demonstrates nation-state-level network interception capabilities and targets primarily Chinese-speaking organizations.