Felismus Malware Written By The Sowbug Group

Cyber security company Symantec recently identified a new cyber espionage group called “Sowbug” that targets governments initially in South East Asia and South America.  Sowbug uses a sophisticated piece of malware called “Felismus” that was discovered earlier this year by Forcepoint Security Labs.

It is currently unknown how Felismus infiltrates a target’s network but once deployed it can maintain a persistent presence, avoiding detection by disguising itself as an Adobe or Word file. The operators of the malware also appear to work outside the usual business hours of the victim, possibly to avoid arousing suspicion from legitimate users.

Sowbug uses Felismus to predominantly steal information relating to foreign policy, diplomatic relations and, specifically, Asia-Pacific relations.  It has also been seen searching for files on remote shares in an attempt to infect other computers on the network.

Sowbug has probably been operating since at least early 2015, but its stealthy capabilities have enabled it to remain very low profile and evade detection.

Sowburg’s identity and primary motivation is currently unknown. There has been speculation this could be a state sponsored group due to the government targets, the sophistication of Felismus, and its success.  Some of the malware code appeared to indicate that the operators’ first language may not be English.

Upon execution, the malware makes a series of innocuous looking HTTP requests to www[]cosecman[]com seemingly designed to look like normal browsing/shopping activity:

(i)   GET /notice/news/items.php?V=ca09a22378d1673b&U= HTTP/1.1
(ii)  GET /notice/news/items.php?V=ca09a22378d1673b&M=f871ff6f939cecf8&U=fe41320b0e4c5d1a
(iii) POST /notice/items/products.php?mobfhvkaqmrmsjjalllpdtkizewqx

Analysis of these requests and their associated responses show them to be part of the malware’s setup process.

Associated Domains & IP Addresses To Block

unmailhome[]com and, and and and



Duncan Newell

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: