Go implant "SecBox" with AES-256-GCM Dead Drop Resolver and steganographic webshells hiding payloads in PNG pixel data

Research on a campaign where a Chinese-speaking operator deployed a Go-based implant framework called SecBox alongside GLUTTON webshells that transport executable bytecode inside PNG images.

SecBox connects over TCP, TLS, WebSocket, KCP, or QUIC with Yamux multiplexing. It uses a Dead Drop Resolver that pulls AES-256-GCM encrypted C2 endpoints from Pastebin or GitHub Gist, so the operator can rotate infrastructure without pushing new binaries. Recovered DDR routes included short-lived TryCloudflare domains. The Windows builds fake Microsoft PE metadata (product: "System Configuration Utility", internal name: syscfg.exe).

The GLUTTON webshell system is the more interesting part from a delivery perspective. A small server-side loader (JSP, ASPX, ASHX, SOAP, or Razor) accepts a PNG in the request body. It reads pixels row-major, concatenates RGB bytes, XORs with a fixed 16-byte key, and looks for FF 88 00 as the end marker. The result is executable bytecode loaded through a classloader (Java) or Assembly.Load (.NET) directly into memory. The visible server file is just a generic decoder, the actual implant arrives inside image pixels.

The campaign also used a fake MySQL server as an initial access vector, returning crafted serialized Java objects when vulnerable clients connected, which triggered second-stage downloads.

Full IOC tables and sample hashes: https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia