SLIME88

Executive Summary

SLIME88 is a China‑aligned APT that leverages critical infrastructure CVEs—most notably Apache ActiveMQ CVE‑2026‑34197 and Office document vulnerabilities—to deploy its own RAT (SoxAgent) and other backdoors such as AdaptixC2. The group constructs an encrypted SOCKS5 relay network (GOBLIN14), masks C2 traffic with Cloudflare, and uses spear‑phishing campaigns that impersonate legitimate certificate installers to compromise energy, manufacturing, and state agencies across the US, Korea, India, France and beyond.

Goals & Targeting

SLIME88’s strategic objectives appear dual‑faced: financial gain through ransomware or data sale, and strategic sabotage of state‑critical systems. By targeting manufacturing, energy, telecommunications, and defense sectors in key geopolitical regions, the actor seeks to erode industrial resilience and secure sensitive operational intelligence. The reliance on low‑cost techniques—such as spear‑phishing and public CVE exploitation—indicates an intent to maintain a broad threat surface while keeping costs minimal. Ultimately SLIME88’s overarching aim is to position itself as a persistent backdoor operator that can be leveraged for extortion or geopolitical leverage.

Key Capabilities

• Spear‑phishing via malicious Microsoft Word documents exploiting EPS dict copy use‑after‑free
• Exploitation of CVE-2015-1701 local Windows privilege escalation
• Exploitation of CVE-2026-34197 in Apache ActiveMQ through crafted Jolokia API requests for remote code execution
• Use of default admin/admin credentials and CVE-2024-32114 to bypass authentication
• Deployment of SoxAgent RAT on Linux, establishing SOCKS5 relay network GOBLIN14
• Delivery and use of downloader IRONHALO and backdoor ELMER
• Phishing campaigns with fake certificate installers targeting energy sector
• Use of AdaptixC2 and CobaltStrike for persistence
• Cloudflare‑proxied C2 to obfuscate IPs
• AES‑encrypted dynamic tunnels
• Self‑update and self‑deletion capabilities

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

SLIME88 demonstrates a high operational tempo, with rapid exploitation of newly disclosed CVEs and the ability to pivot across multiple sectors within weeks. Victims are primarily governmental agencies, defense contractors, energy utilities, and manufacturing facilities—organizations that typically run exposed messaging or monitoring software (e.g., Apache ActiveMQ). The group’s campaigns exhibit a modular architecture: initial compromise via spear‑phishing or public vulnerability, deployment of a lightweight RAT or backdoor, followed by lateral movement through privileged credentials and establishment of secure C2 tunnels. Recent attacks show the actor can pivot from Linux systems to Windows targets using the same weapon suite (IRONHALO/ELMER), underscoring its cross‑platform flexibility.

IOC Patterns

• domain
• file
• email
• ip-v4
• hash-sha256

Recommended Actions

• Apply patches for Microsoft Office to mitigate malicious document exploitation.
• Patch local Windows systems against CVE‑2015‑1701 and enforce least privilege on administrative accounts.
• Update or disable the Jolokia API endpoint in Apache ActiveMQ, applying CVE-2026-34197 mitigations promptly.
• Enforce strong authentication (e.g., change default admin credentials) for all messaging services.
• Deploy network segmentation to isolate critical manufacturing and IT infrastructure from exposed services.
• Implement detection rules that flag SoxAgent or CobaltStrike activity and anomalous outbound traffic through Cloudflare proxies.
• Conduct regular vulnerability scans for CVE-2024-32114 and other Apache ActiveMQ exploits.
• Monitor broker logs for malformed XML requests and HTTP traffic patterns indicative of exploitation attempts.
• Set up blocking of known C2 IPs and Cloudflare‑proxied addresses at the perimeter firewall.
• Provide spear‑phishing awareness training to users, emphasizing document and certificate source verification.

Suggested Tags