zwShell

Executive Summary

zwShell is a long‑standing Delphi‑based RAT used in the Night Dragon supply‑chain attack against critical infrastructure. It provides remote control, data exfiltration, and additional payload delivery, posing significant risk to Windows systems. Security teams should treat any unidentified outbound traffic from known zwShell binaries as high‑severity indicator of compromise.

zwShell is a remote access trojan (RAT) developed in Delphi for Windows platforms that has been active since the spring of 2010. The tool was first publicly identified within the Night Dragon campaign, a high-profile supply‑chain attack carried out by state-sponsored actors targeting government and infrastructure organizations worldwide. In this campaign, zwShell was leveraged to remotely control infected hosts, exfiltrate data, and execute additional payloads. Operationally, zwShell demonstrates typical RAT capabilities: it establishes encrypted command‑and‑control channels, accepts a variety of remote commands including file manipulation, screen capture, process enumeration, and keystroke logging, and can download auxiliary malware or scripts. The Delphi codebase is compiled with obfuscation techniques that hinder static analysis, while dynamic behaviors such as persistence via registry modifications and DLL injection have been documented by multiple security labs.

Key Capabilities

• Establish encrypted command-and-control channel
• Remote desktop capture and screen sharing
• File system navigation and manipulation (upload/download/delete)
• Process enumeration and termination
• Keystroke logging
• Persistence via registry modifications and startup folder entry
• DLL injection into trusted processes
• Download and execute additional malware scripts

ATT&CK Techniques

Recommended Actions

• Deploy advanced endpoint detection and response solutions capable of detecting Delphi‑based RATs.
• Block outbound traffic from known zwShell DLL or executable hashes to external IPs on non‑standard ports.
• Monitor for anomalous PowerShell/command shell activity, especially connections to suspicious C2 domains.
• "Sign off" unused Windows services that show no legitimate business need and re-scan for registry persistence keys associated with RATs.
• Educate users about phishing vectors that could deliver initial drops of zwShell.

Suggested Tags