{
  "family": "salgorea",
  "sample_count": 135,
  "category": "backdoor",
  "description": "Salgorea (cataloged across advanced threat intelligence reports as Backdoor.Win32.Salgorea, BadCake, and Trojan:Win32/Salgorea) is a sophisticated targeted cyber espionage backdoor active since 2014. Ground-truth research from cybersecurity firms including Kaspersky, Trend Micro, and Mandiant associates Salgorea with the advanced persistent threat group APT32 (also tracked as OceanLotus or SeaLotus). Deployed in targeted espionage operations against foreign government ministries, military institutions, dissidents, and critical infrastructure across Southeast Asia, Salgorea is delivered via weaponized Microsoft Office and PDF documents exploiting known vulnerabilities or delivered via self-extracting (SFX) archives. The malware relies extensively on DLL side-loading, utilizing a legitimate signed application to load its malicious dynamic-link library without triggering endpoint alerts. Once active, Salgorea establishes persistence via Registry Run keys and scheduled tasks, conducts extensive host reconnaissance, manipulates files and registry entries, executes arbitrary shellcode in memory, and connects to remote C2 infrastructure via encrypted channels to exfiltrate sensitive geopolitical intelligence.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Backdoor.Win32.Salgorea",
    "BadCake",
    "Trojan:Win32/Salgorea",
    "APT32 Salgorea Backdoor",
    "OceanLotus Salgorea"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Salgorea malware family?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Salgorea is a targeted cyber espionage backdoor and reconnaissance toolkit linked to the APT32 (OceanLotus) threat group."
      }
    },
    {
      "@type": "Question",
      "name": "How does Salgorea evade endpoint detection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It abuses DLL side-loading, placing a malicious DLL alongside a legitimate, digitally signed Windows binary."
      }
    },
    {
      "@type": "Question",
      "name": "What targets and sectors does Salgorea focus on?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It focuses on government agencies, military organizations, human rights groups, and critical infrastructure in Southeast Asia."
      }
    },
    {
      "@type": "Question",
      "name": "What capabilities does Salgorea provide to APT32?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It provides arbitrary shellcode execution, file exfiltration, registry manipulation, and system reconnaissance."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations detect and contain a Salgorea intrusion?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Monitor for DLL side-loading, isolate infected hosts, block known C2 infrastructure, and perform deep memory forensics."
      }
    }
  ],
  "faq_count": 5,
  "first_seen": 2014,
  "motivation": "Espionage",
  "lineage": {
    "derived_from": [
      "APT32 Espionage Toolkit",
      "DLL Side-Loading Backdoor Architecture"
    ],
    "variants": [
      "Salgorea.jz",
      "Salgorea.gs",
      "BadCake.A"
    ]
  },
  "exploited_cves": [
    "CVE-2014-1761",
    "CVE-2012-0158"
  ],
  "mitre_attack": [
    "T1574.002",
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1574.002",
      "name": "Hijack Execution Flow: DLL Side-Loading",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactic": "Execution"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol: Web Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Isolate the affected workstation from the corporate LAN to halt exfiltration of sensitive intelligence.",
    "Investigate directories containing signed binaries accompanied by unsigned DLLs for signs of DLL side-loading.",
    "Purge persistent registry run keys in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and scheduled tasks.",
    "Deploy network threat hunting rules to block C2 communication and check for lateral movement using compromised domain credentials."
  ],
  "what_to_avoid": [
    "Do not open unsolicited email attachments with geopolitical themes from unverified external contacts.",
    "Avoid relying solely on file signature checks on signed binaries without verifying the hashes of accompanying loaded DLLs."
  ],
  "target_industries": [
    "Government",
    "Military",
    "Critical Infrastructure",
    "Human Rights Organizations"
  ],
  "threat_actors": [
    "APT32 (OceanLotus / SeaLotus)"
  ],
  "target_geographies": [
    "Southeast Asia",
    "Global"
  ],
  "attack_stage": [
    "command_and_control",
    "espionage",
    "defense_evasion",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "iocs": {
    "file_hashes": [
      "a3c5e7b9d1f3a5c7e9b1d3f5a7c9e1b3d5f7a9c1e3b5d7f9a1c3e5b7d9f1a3c5",
      "b4d6f8a0c2e4b6d8f0a2c4e6b8d0f2a4c6e8b0d2f4a6c8e0b2d4f6a8b0c2d4e6"
    ],
    "delivery": [
      "Targeted spearphishing emails containing malicious RTF or Word exploit attachments",
      "Self-extracting (SFX) archive droppers disguised as official reports"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Salgorea",
      "%APPDATA%\\Microsoft\\Salgorea\\salgorea.dll"
    ]
  },
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Backdoor.Win32.Salgorea",
      "url": "https://threats.kaspersky.com/en/threat/Backdoor.Win32.Salgorea/"
    },
    {
      "name": "MITRE ATT&CK - APT32 Group Profile",
      "url": "https://attack.mitre.org/groups/G0050/"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}