S1044: FunnyDream
FunnyDream is a backdoor with multiple components that was used during the FunnyDream campaign since at least 2019, primarily for execution and exfiltration.[1]
Security context for executives and security teams
S1044: FunnyDream describes [FunnyDream](https://attack.mitre.org/software/S1044) is a backdoor with multiple components that was used during the [FunnyDream](https://attack.mitre.org/campaigns/C0007) campaign since at least 2019, primarily for execution and exfiltration.(Citation: Bitdefender FunnyDream Campaign November 2020)
Executive priority
S1044: FunnyDream is an official MITRE ATT&CK software. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate S1044: FunnyDream by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (Windows), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
- Network, endpoint, and security-tool telemetry
Detection direction
- Validate whether S1044: FunnyDream appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
FunnyDream
FunnyDream is a backdoor with multiple components that was used during the FunnyDream campaign since at least 2019, primarily for execution and exfiltration.[1]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1543.003 | Windows ServiceSub-technique | FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.[1] |
| Enterprise | T1547.001 | Registry Run Keys / Startup FolderSub-technique | FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.[1] |
| Enterprise | T1047 | Windows Management Instrumentation | FunnyDream can use WMI to open a Windows command shell on a remote machine.[1] |
| Enterprise | T1120 | Peripheral Device Discovery | The FunnyDream FilepakMonitor component can detect removable drive insertion.[1] |
| Enterprise | T1074.001 | Local Data StagingSub-technique | FunnyDream can stage collected information including screen captures and logged keystrokes locally.[1] |
| Enterprise | T1559.001 | Component Object ModelSub-technique | FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.[1] |
| Enterprise | T1218.011 | Rundll32Sub-technique | FunnyDream can use `rundll32` for execution of its components.[1] |
| Enterprise | T1055.001 | Dynamic-link Library InjectionSub-technique | The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.[1] |
| Enterprise | T1572 | Protocol Tunneling | FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.[1] |
| Enterprise | T1057 | Process Discovery | FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.[1] |
| Enterprise | T1036.004 | Masquerade Task or ServiceSub-technique | FunnyDream has used a service named `WSearch` for execution.[1] |
| Enterprise | T1041 | Exfiltration Over C2 Channel | FunnyDream can execute commands, including gathering user information, and send the results to C2.[1] |
| Enterprise | T1018 | Remote System Discovery | FunnyDream can collect information about hosts on the victim network.CitationKaspersky APT Trends Q1 2020 |
| Enterprise | T1056.001 | KeyloggingSub-technique | The FunnyDream Keyrecord component can capture keystrokes.[1] |
| Enterprise | T1016 | System Network Configuration Discovery | FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.[1] |
| Enterprise | T1033 | System Owner/User Discovery | FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.[1] |
| Enterprise | T1124 | System Time Discovery | FunnyDream can check system time to help determine when changes were made to specified files.[1] |
| Enterprise | T1012 | Query Registry | FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.[1] |
| Enterprise | T1119 | Automated Collection | FunnyDream can monitor files for changes and automatically collect them.[1] |
| Enterprise | T1113 | Screen Capture | The FunnyDream ScreenCap component can take screenshots on a compromised host.[1] |
| Enterprise | T1090 | Proxy | FunnyDream can identify and use configured proxies in a compromised network for C2 communication.[1] |
| Enterprise | T1560.002 | Archive via LibrarySub-technique | FunnyDream has compressed collected files with zLib.[1] |
| Enterprise | T1105 | Ingress Tool Transfer | FunnyDream can download additional files onto a compromised host.[1] |
| Enterprise | T1070 | Indicator Removal | FunnyDream has the ability to clean traces of malware deployment.[1] |
| Enterprise | T1106 | Native API | FunnyDream can use Native API for defense evasion, discovery, and collection.[1] |
| Enterprise | T1005 | Data from Local System | FunnyDream can upload files from victims' machines.[1]CitationKaspersky APT Trends Q1 2020 |
| Enterprise | T1001 | Data Obfuscation | FunnyDream can send compressed and obfuscated packets to C2.[1] |
| Enterprise | T1560.003 | Archive via Custom MethodSub-technique | FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.[1] |
| Enterprise | T1025 | Data from Removable Media | The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.[1] |
| Enterprise | T1518.001 | Security Software DiscoverySub-technique | FunnyDream can identify the processes for Bkav antivirus.[1] |
| Enterprise | T1059.003 | Windows Command ShellSub-technique | FunnyDream can use `cmd.exe` for execution on remote hosts.[1] |
| Enterprise | T1027.013 | Encrypted/Encoded FileSub-technique | FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.[1] |
| Enterprise | T1680 | Local Storage Discovery | FunnyDream can enumerate all logical drives on a targeted machine.[1] |
| Enterprise | T1070.004 | File DeletionSub-technique | FunnyDream can delete files including its dropper component.[1] |
| Enterprise | T1083 | File and Directory Discovery | FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.[1] |
| Enterprise | T1095 | Non-Application Layer Protocol | FunnyDream can communicate with C2 over TCP and UDP.[1] |
| Enterprise | T1010 | Application Window Discovery | FunnyDream has the ability to discover application windows via execution of `EnumWindows`.[1] |
Groups, software, and campaigns
C0007: FunnyDream
FunnyDream was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Security researchers linked the FunnyDream campaign to possible Chinese-speaking threat actors through the use of the Chinoxy backdoor and noted infrastructure overlap with the TAG-16 threat group.[1][2][3]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(2)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.2 | 1.1 | Current bundle | c4847b4261b4… | ||
| 19.1 | 1.1 | Older bundle | c4847b4261b4… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Bitdefender FunnyDream Campaign November 2020
Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
Open source URL - [2]mitre-attackS1044Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.