TunnelSnake__2021__Operation_TunnelSnake_Securelist.pdf

This report analyzes Operation TunnelSnake, detailing the Moriya rootkit (kernel driver and user-space agent), its covert communication channel via Windows Filtering Platform, infection via public-facing servers, post-exploitation toolsets for lateral movement and data exfiltration, and multiple related tools (IISpy, BOUNCER, Earthworm, Termite). It documents targeted regional diplomatic organizations in Asia, Africa, and South Asia, timelines dating back to 2018, and discusses suspected Chinese-speaking threat actors, with numerous IOCs and indicators of compromise provided.