RegPhantom: China-Nexus Windows Kernel Rootkit Enabling Stealthy Kernel-Mode Code Execution via Registry Trigger — Threadlinqs Intelligence
As of 2026-05-30, RegPhantom: China-Nexus Windows Kernel Rootkit Enabling Stealthy Kernel-Mode Code Execution via Registry Trigger is a critical-severity malware threat attributed to a China-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 13 indicators of compromise.
Threat ID: TL-2026-0271 · Severity: CRITICAL · Status: MONITORING · Category: MALWARE
Attribution: China · ESPIONAGE
RegPhantom is a stealthy Windows kernel rootkit attributed to a China-nexus threat actor that abuses the Windows registry as a covert command trigger mechanism. The signed kernel driver intercepts
RegPhantom represents a sophisticated kernel-mode rootkit designed for stealth execution in the Windows kernel. The malware operates as a legitimately signed Windows kernel driver (.sys file), leveraging valid code-signing certificates issued to Chinese companies — Guangzhou Xuanfeng Technology Co., Ltd. and Autel Intelligent Technology Corp., Ltd. — to pass Microsoft's driver signing enforcement.
The core innovation of RegPhantom is its use of the Windows registry as a covert command channel. An unprivileged usermode process writes an XOR-encrypted command to any registry key. The kernel driver intercepts this write via the CmRegisterCallback kernel API, decrypts the payload using a built-in XOR key, and reflectively loads an arbitrary Portable Executable (PE) image into kernel memory. This technique is particularly insidious because registry write activity is ubiquitous on Windows systems and blends into normal system noise.
The reflective loading mechanism bypasses standard driver loading infrastructure entirely. Instead of using the Windows driver loader, RegPhantom manually maps the PE into kernel memory, resolving imports and relocations in-memory. This means the loaded code never appears in kernel module lists, making it invisible to tools that enumerate loaded drivers (such as lm in WinDbg or driver listing utilities).
RegPhantom implements a multi-layered anti-forensic strategy:
1. Registry Write Blocking: The driver returns STATUS_ACCESS_DENIED before the registry write completes, ensuring the command payload is never committed to the registry. No registry value is created or modified, leaving zero persistent artifacts.
2. Payload Memory Wiping: After executing the reflectively loaded payload, the driver overwrites the kernel memory region with zeros, destroying forensic evidence.
3. Hook Pointer Encoding: All hook pointers are XOR-encoded with a global key (g_xor_decode_key) and only decoded at call time, adding a layer of obfuscation to memory forensics.
4. Callback Hijacking: The loaded payload can further hijack the driver's kernel callbacks, enabling persistent kernel-mode hooks without additional driver loads.
The driver binary is protected with Control Flow Guard (CFG) obfuscation incorporating opaque predicates and duplicated basic blocks designed to impede static analysis. However, the variety of opaque predicates used is low — the same patterns are reused across the binary — making the obfuscation vulnerable to pattern-based CFG simplification.
The observed sample set spans at least June 18, 2025 through August 6, 2025, based on compilation timestamps and VirusTotal first-submission dates. Multiple samples compiled over several months, signed with two distinct Chinese certificates, and submitted from multiple countries indicate an actively maintained offensive tool. Attribution to a China-nexus threat actor is assessed at moderate confidence based on certificate provenance, sample timeline patterns, submission geography, and shared development traits across the sample corpus.
Weaknesses (CWE)
CWE-829, CWE-693, CWE-345
Target sectors: government, defense, technology, telecommunications, critical-infrastructure
Target regions: Asia-Pacific, Europe, North America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 13 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, CRITICAL, threat intelligence, cybersecurity, T1587, T1588, T1106, T1547, T1543, T1068, T1014, T1112, T1553, T1620