Security researchers have uncovered a new PHP malware possibly linked to the Chinese hacking group Winnti (APT 41). The malware, named Glutton, is a highly modular ELF-based backdoor seen used against popular PHP frameworks such as ThinkPHP, Laravel, Yii, and Dedecms. Researchers believe Glutton could be linked to Winnti, but ties are not certain as the malware is uncharacteristically conspicuous. Glutton does not encrypt command-and-control communications, and its samples are not obfuscated. The malware was discovered in April 2024, and campaigns could have begun as early as December 2023. The malware’s code execution occurs within PHP or PHP-FRM processes, maintaining stealth via fileless execution. Glutton modifies system files to establish persistence between reboots and can exfiltrate data from the victim filesystem. The backdoor supports twenty-two (22) commands and is designed to harvest system information, provide persistent access to the victim system, and perform code injection. Initial access is unknown, although researchers believe that is achieved through the exploitation of vulnerabilities and brute-force attacks. The backdoor is also unique because it has been found embedded in software packages sold on cybercrime forums, likely targeting other hackers. Once downloaded, Glutton deploys a “HackBrowserData” tool to steal information such as passwords, cookies, credit card information, and browsing history from web browsers. CTIX analysts will continue to report on new and emerging forms of malware and associated campaigns.