Sakula

Description

Sakula (a.k.a. Viper, Sakurel) is a backdoor associated with the Deep Panda threat group that targets Windows systems for remote access and data exfiltration through encrypted payloads. It reached victims through watering hole attacks on targeted websites and malicious downloads, and its operators favored quiet, persistent access to collect intelligence. The family's campaigns against technology and think tank targets made it a marker of Chinese state sponsored espionage in the 2010s.

Stats

First seen: May 2022
Last seen: October 2026

Also known as

SakurelViper

MITRE ATT&CK techniques

11 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.003Windows Command Shell

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1070Indicator Removal
- T1070.004File Deletion
T1218System Binary Proxy Execution
- T1218.011Rundll32
T1574Hijack Execution Flow
- T1574.001DLL

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1105Ingress Tool Transfer
T1573Encrypted Channel
- T1573.001Symmetric Cryptography

Associated groups

G0009Deep Panda

Alert name variants

Alert Name	Engine
CMD:Heur.BZC.PZQ.Viper.4.4DC18938	AV
CMD:Heur.BZC.PZQ.Viper.4.D5BF9750	AV
CMD:Heur.BZC.PZQ.Viper.4.F76300ED	AV
Heur.BZC.PZQ.Viper.4.071536E5	AV
Heur.BZC.PZQ.Viper.4.0822DC20	AV
Heur.BZC.PZQ.Viper.4.1496E17B	AV
Heur.BZC.PZQ.Viper.4.15E6C41F	AV
Heur.BZC.PZQ.Viper.4.15E91EF6	AV
Heur.BZC.PZQ.Viper.4.168E9CB5	AV
Heur.BZC.PZQ.Viper.4.17DE85F7	AV
Heur.BZC.PZQ.Viper.4.18DCECC7	AV
Heur.BZC.PZQ.Viper.4.26A2A39A	AV
Heur.BZC.PZQ.Viper.4.4C042BB1	AV
Heur.BZC.PZQ.Viper.4.572A0540	AV
Heur.BZC.PZQ.Viper.4.6A2EDB86	AV
Heur.BZC.PZQ.Viper.4.6B2A9BBA	AV
Heur.BZC.PZQ.Viper.4.6C265CE4	AV
Heur.BZC.PZQ.Viper.4.6C268768	AV
Heur.BZC.PZQ.Viper.4.A59FBBAF	AV
Heur.BZC.PZQ.Viper.4.B2E30791	AV
Heur.BZC.PZQ.Viper.4.D774973C	AV
Win32.Backdoor.Sakurel	ATP Sandbox Adv. Heuristics
Win32.Trojan.Sakurel	ATP Sandbox Adv. Heuristics

Related IPS Signatures

Signature Name	Engine
MALWARE-CNC Sakula.Generic suspicious traffic detected	IPS-SWG

Related families

InvisiMole KONNI Bisonal PlugX QakBot