Threat reportMalwareTL-2026-4846
BloodAlchemy RAT - Evolved Deed RAT Variant with ShadowPad Code Lineage
BloodAlchemy RAT (TL-2026-4846), also tracked as BLOODALCHEMY, is a medium-severity malware campaign, first published 2026-10-30. It is linked to a China-nexus actor with low confidence, affects Microsoft Windows, maps to 15 MITRE ATT&CK techniques (T1027, T1053.005, T1055.004), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4846
- Threat ID
- TL-2026-4846
- Also known as
- BLOODALCHEMY, Deed RAT variant
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- government administration, technology
- Target regions
- Southeast Asia, South Asia, Asia
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in BloodAlchemy RAT
Malware and tooling: BloodAlchemy, SNAPPYBEE, ShadowPad, ShadowPad
How BloodAlchemy RAT works
ITOCHU Cyber & Intelligence analysis identifies BloodAlchemy (BLOODALCHEMY) as an evolution of Deed RAT rather than new malware, with code similarities suggesting shared lineage with ShadowPad. It uses a multi-stage infection chain with legitimate-binary DLL side-loading, encrypted shellcode and Early Bird injection, and supports 15 backdoor commands.
BLOODALCHEMY is an x86 backdoor written in C, first documented by Elastic Security Labs on 2023-10-13 in connection with the REF5961 intrusion set targeting ASEAN government entities. ITOCHU Cyber & Intelligence (2024-05-23) concluded that it is an evolved Deed RAT variant. Deed RAT was previously associated exclusively with the Space Pirates group, and is viewed as a successor to ShadowPad. The shared traits include the unique payload header data structure (magic 45 AB 45 AB, plugin ID 0x10) and a similar virtual function table per protocol ID. Lineage described in the source: ShadowPad -> Deed RAT -> BloodAlchemy.
Infection chain: the reported initial access vector is takeover of a vendor maintenance account on a VPN device. Three files are then placed in C:\windows\: the legitimate, signed Brother Industries binary BrDifxapi.exe (vulnerable to DLL side-loading), the malicious loader BrLogAPI.dll, and DIFX, an encrypted shellcode container. BrLogAPI.dll decrypts the shellcode from DIFX using AES-128-CBC, with the key being the first 16 bytes of the DIFX file. The shellcode then decrypts the final payload using a custom routine based on the FNV-1a hash combined with LZNT1 decompression. Configuration is protected by a custom single-byte XOR variant with bit rotation. Persistence for the loader set uses a scheduled task at C:\Windows\System32\Tasks\Dell\BrDifxapi.
Run modes 0-6 control behavior: 0 is full operation (C2, backdoor, process injection, anti-debug, anti-sandbox, persistence); 1 is C2 and backdoor only; 2 is threading for C2; 3 is C2, backdoor, injection, anti-analysis and persistence; 4 is process creation for injection; 5 is named pipe creation; 6 is malware installation. Persistence selected by persistence_flag (1-4) uses a service, startup, and COM-based Task Scheduler in combinations, installing test.exe into %AUTOPATH%\Test\, %LocalAppData%\Programs\Test\, %ProgramFiles%\Test\ or %ProgramFiles(x86)%\Test\. Encrypted configuration is stored in C:\ProgramData\Store\ under a 15-character [a-zA-Z] file name. Injection uses the Early Bird technique (QueueUserAPC) into SearchIndexer.exe, wininit.exe, taskhost.exe, svchost.exe or taskeng.exe. Anti-sandbox checks process names (Trellix-focused), file artifacts and DNS results; anti-debugging is enabled in run modes 0 and 3.
The backdoor supports 15 commands (0x1101 update config, 0x1102 retrieve config, 0x1201/0x1202/0x1203 update test.exe/BrLogAPI.dll/DIFX, 0x1204 uninstall and terminate, 0x1205 launch test.exe, 0x1302 load payload and store in registry, 0x1303 delete registry value, 0x1401/0x1402 retrieve/update proxy info, 0x1501 gather victim information, 0x1502 echo, plus 0x1301 and 0x1304 of unknown function). Up to 10 C2 destinations are supported (one observed). Elastic reports communication over HTTP (URI /Inform/logger/), named pipes or sockets across DNS, HTTPS, TCP, UDP and SOCKS with optional encryption. Reported victims are government organizations in Southern and Southeast Asia (ASEAN); Trend Micro's Earth Estries research (Botconf 2024, Into the Vapor) also tied a new Deed RAT variant to government and technology targets in the Philippines, Taiwan, South Africa, Germany and the United States. Attribution is not confirmed: PolySwarm cites Vapor Panda as a suspected, unconfirmed actor, and the hunt context names Space Pirates, APT41, RedHotel and TAG-22 as related ShadowPad-family users. No domains, IPs or C2 infrastructure were published in the sources.
MITRE ATT&CK techniques used in TL-2026-4846
Defense Evasion
T1027 Obfuscated Files or Information; T1055.004 Asynchronous Procedure Call; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574.001 DLL
Execution
Persistence
T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1055.004 Asynchronous Procedure Call
Command and Control
T1071.001 Web Protocols; T1090 Proxy; T1095 Non-Application Layer Protocol; T1573 Encrypted Channel
Initial Access
Discovery
T1082 System Information Discovery
defense-impairment
stealth
Affected products and versions in BloodAlchemy RAT
- Microsoft — Windows
Vulnerable versions: Windows systems reachable via compromised VPN maintenance accounts
Remediation for BloodAlchemy RAT
Immediate actions
- Hunt for BrDifxapi.exe, BrLogAPI.dll and DIFX in C:\windows\ and for the Dell\BrDifxapi scheduled task
- Review and rotate vendor/maintenance accounts on VPN devices and audit their recent logins
- Search for 15-character [a-zA-Z] config files in C:\ProgramData\Store\ and test.exe under ...\Test\ directories
Workarounds
- Restrict vendor VPN account access to just-in-time, monitored sessions
- Block execution of signed binaries from C:\windows\ root via application control
Longer-term hardening
- Deploy EDR with detection for Early Bird (QueueUserAPC) injection into SearchIndexer.exe, wininit.exe, taskhost.exe, svchost.exe and taskeng.exe
- Enforce MFA and access monitoring on third-party and maintenance accounts
- Monitor for signed-binary DLL side-loading from non-standard directories
Weaknesses (CWE) in BloodAlchemy RAT
Timeline of BloodAlchemy RAT
- ShadowPad first seen (July 2017); Deed RAT later assessed as its successor and linked to the Space Pirates group.
- Positive Technologies reports Space Pirates using Deed RAT against Russian aerospace and other entities in 2022.
- BloodAlchemy first observed in the wild per PolySwarm (May 2023), targeting government entities in Southern and Southeast Asia.
- Trend Micro publishes Earth Estries campaign research (August 2023) on government and technology targets; a Deed RAT variant is later tied to it.
- Elastic Security Labs publicly names and documents BLOODALCHEMY, used by the REF5961 intrusion set against ASEAN governments.
- ITOCHU Cyber & Intelligence publishes 'Malware Transmutation!', identifying BloodAlchemy as an evolved Deed RAT variant with ShadowPad lineage and documenting 15 commands and run modes 0-6.
- PolySwarm reports BloodAlchemy targeting government entities in Asia, noting Vapor Panda as a suspected (unconfirmed) actor.
Sources cited for BloodAlchemy RAT
- Malware Transmutation! - Unveiling the Hidden Traces of BloodAlchemy
- Disclosing the BLOODALCHEMY backdoor (Elastic Security Labs)
- Japanese Experts Warn of BLOODALCHEMY Malware (The Hacker News)
- BloodAlchemy targeted government entities in Asia (PolySwarm)
- Into the Vapor: Tracking Down Unknown Panda's Claw Marks (Botconf 2024)
- Botconf 2024 slides - Into the Vapor (ITOCHU Cyber & Intelligence)
- Space Pirates: a look into the group's unconventional techniques, new attack vectors and tools (PT ESC)
- Novel BLOODALCHEMY malware examined (SC Media)
Detection coverage for TL-2026-4846
As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4846 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.