Article
APT27
APT27 is a China-aligned APT active since 2012, targeting government, defense, and critical infrastructure using advanced espionage tactics.
Read more
Malware profile
Derusbi
Also known as Derusbi/PHOTO
Derusbi is malware that MITRE ATT&CK says is used by multiple Chinese APT groups.
In short
Derusbi is malware that MITRE ATT&CK says is used by multiple Chinese APT groups. Both Windows and Linux variants have been observed. MITRE records abilities such as logging keystrokes, capturing screen, audio and video, running a remote shell and deleting files.
- Names2names in public reportsDerusbi · PHOTO
- Techniques17ATT&CK techniques listedCommand and Control · Discovery · Stealth
- Linked Groups2groups that use itAPT40 threat group profile · APT41
In one minute
- What it is
- Malware used by multiple Chinese APT groups, with Windows and Linux variants, according to MITRE ATT&CK.
- What it does
- Logs keystrokes, captures screen, audio and video, runs a remote shell, lists files and processes, and deletes files. The Linux version needs root rights to run.
- Who uses it
- Attributed by CISA, with the FBI, on 19 July 2021 to APT40 actors, and listed by the FBI, with CISA, on 16 September 2020 among malware of the group tied to the APT 41 indictment. MITRE also lists Axiom and Deep Panda, which have no page here.
- How it gets in
- The sources we opened do not say how Derusbi is delivered. CISA lists APT40's general ways in: stolen credentials, exposed remote services, phishing and public-facing applications.
- What to do first
- Follow the CISA advisory AA21-200A: patch internet-facing servers, use multi-factor authentication and watch DNS and server disk use.
What it does
MITRE says Derusbi is used by several Chinese APT groups, so it is not tied to one actor. It records both a Windows and a Linux version.
US government documents list it among the tools of two groups: the one behind the 2020 APT 41 indictment and the APT40 actors indicted in 2021.
Names
Public sources use several names for this malware.
| Name | Where it appears |
|---|---|
| Derusbi | MITRE ATT&CK software S0021, CISA advisory AA21-200A ("Derusbi/PHOTO") and FBI alert AC-000133-TT[1, 2, 3] |
| PHOTO | MITRE ATT&CK Associated Software, and written "Derusbi/PHOTO" in CISA advisory AA21-200A[1, 2] |
What it can do
What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.
Command and Control
Fallback Channels T1008
It has a backup way to talk to its operators, using an HTTP beacon.[1]
Non-Application Layer Protocol T1095
It binds to a raw socket on a random source port between 31800 and 31900 for command traffic.[1]
Non-Standard Port T1571
It has sent unencrypted HTTP over port 443 for command traffic.[1]
Encrypted Channel: Symmetric Cryptography T1573.001
It hides command traffic with variable 4-byte XOR keys.[1]
Discovery
Query Registry T1012
It can list Registry keys and values.[1]
System Owner/User Discovery T1033
The Linux version checks it runs as root and will not run otherwise. It also collects the username.[1]
Process Discovery T1057
It collects the current and parent process IDs.[1]
System Information Discovery T1082
It gathers the host name, the GCC version and details of the CPU, machine and operating system.[1]
File and Directory Discovery T1083
It can list directories, files and drives.[1]
Stealth
Process Injection: Dynamic-link Library Injection T1055.001
It injects itself into the secure shell (SSH) process.[1]
Indicator Removal: File Deletion T1070.004
It can delete files. MITRE says it has loaded a Linux kernel module, then deleted it from disk and overwritten the data with null bytes.[1]
Indicator Removal: Timestomp T1070.006
It can change file timestamps.[1]
Collection
How it spreads
The sources we could open do not describe how Derusbi reaches a victim. The CISA advisory on APT40 says that group got in through stolen credentials, exposed services, phishing and public-facing applications, but it does not say which of these delivered Derusbi.
Timeline
- 16 September 2020
FBI and CISA alert on APT 41 indictment
The FBI, with CISA, published alert AC-000133-TT on the US indictment of five China-based actors. It lists Derusbi among the malware the group has used.[3]
- 19 July 2021
CISA advisory on APT40
CISA published advisory AA21-200A on the DOJ indictment of four APT40 actors, unsealed on 19 July 2021. It lists Derusbi/PHOTO among the malware and tools the group used.[2]
Who uses it
- Threat group APT40 threat group profile APT40 (tracked by MITRE as Leviathan) is attributed by the US and UK governments (2021) and by agencies in eight countries (2024) to China's Ministry of State Security. China · Since 2009
- Threat group APT41 MITRE describes APT41 as a Chinese state-sponsored espionage group, as researchers have assessed it, that also runs financially motivated operations. China · Since 2012
Detection and defense
Patch internet-facing systems
CISA advises installing verified vendor patches, putting internet-connected servers first, and using compensating controls where patching is not possible. It also advises routine audits of patch management.[2]
Protect accounts
CISA advises strong credentials, regular password changes and multi-factor authentication, especially for webmail and VPN, and logging use of administrator commands such as net, ipconfig and ping.[2]
Watch DNS and disk use
CISA advises logging DNS queries, considering blocking outbound DNS not from approved servers, monitoring DNS for command traffic, and watching server disk use for big changes.[2]
Use baselines and reputation services
CISA advises network and system baselines to spot unusual activity, auditing logs, and multi-sourced reputation services for files, DNS, URLs, IPs and email addresses.[2]
Questions
What is Derusbi?
MITRE ATT&CK describes it as malware used by multiple Chinese APT groups, with Windows and Linux variants.
What is PHOTO?
MITRE lists PHOTO as an associated name, and CISA writes "Derusbi/PHOTO" in its APT40 advisory.
Who uses Derusbi?
CISA, in July 2021, listed it among malware and tools used by APT40 actors. The FBI, with CISA, listed it in 2020 among malware used by the group tied to the APT 41 indictment. MITRE also lists Axiom and Deep Panda.
What can it do?
MITRE records keylogging, screen, audio and video capture, a remote Bash shell, file listing and deletion, and command traffic hidden with XOR keys.
How do defenders reduce the risk?
CISA advises prompt patching of internet-facing servers, multi-factor authentication, logging and monitoring DNS, and baselines to spot unusual activity. These are APT40 advice, not Derusbi-only advice.
In our research
- APT27 January 2026
- APT41: China’s Dual-Purpose Cyber Powerhouse November 2025
- APT40 threat group profile Threat group
- APT41 Threat group
Sources
- Derusbi, Software S0021 MITRE ATT&CKSupports: Description, alias PHOTO, platforms, dates, techniques and groups.
- Tactics, Techniques, and Procedures of Indicted APT40 Actors Associated With China's MSS Hainan State Security Department, AA21-200A CISASupports: 19 July 2021 advisory listing Derusbi/PHOTO among APT40 malware, plus mitigations.
- Indictment of China-Based Cyber Actors Associated with APT 41 for Intrusion Activities, Alert AC-000133-TT FBI with CISASupports: 16 September 2020 alert listing Derusbi among malware used by the group.
- Leviathan, Group G0065 MITRE ATT&CKSupports: MITRE lists Derusbi as software of Leviathan (APT40), attributed to MSS Hainan State Security Department.
- APT41, Group G0096 MITRE ATT&CKSupports: MITRE lists Derusbi as software of APT41.
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.