MALWARE FAMILY

8.t Dropper

Internal ID: win.8t_dropper

aliases

Last seen:Mar 17, 2026

Intelligence Profile

8T_Dropper has been used by Chinese threat actor TA428 in order to install Cotx RAT onto victim's machines during Operation LagTime IT. According to Proofpoint the attack was developed against a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. The dropper was delivered through an RTF document exploiting CVE-2018-0798.

Threat Analysis

8.t Dropper is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.malwarelab.pl/posts/on_the_royal_road/

→https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf

→https://community.riskiq.com/article/56fa1b2f

→https://community.riskiq.com/article/5fe2da7f

→https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf

→https://go.recordedfuture.com/hubfs/reports/cta-2022-0922.pdf

→https://ics-cert.kaspersky.com/media/Kaspersky-ICS-CERT-APT-attacks-on-industrial-organizations-in-H1-2021-En.pdf

→https://malgamy.github.io/malware-analysis/The-Approach-of-TA413-for-Tibetan-Targets/#third-stage

→https://medium.com/@Ilandu/portdoor-malware-afc9d0796cba

→https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.8t_dropper

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search 8.t Dropper