CNCERT Alert: Backdoored 'Jianpian Player' Infects 700K+ Windows Devices in China

Overview

On October 9, 2024, the National Internet Emergency Center (CNCERT) issued a risk alert regarding the Windows application "Jianpian Player" (荐片播放器), which contains built-in backdoor functionality. The malware silently collects terminal information, downloads and executes arbitrary programs, and accepts remote commands to run arbitrary code, leading to remote control and personal data leakage.

Malicious Behaviors

Analysis reveals that while providing video playback, the program maintains persistence via registry Run keys and a system service. It possesses the following capabilities:

Silent installation of third‑party software

Collection of terminal fingerprint and behavioral data

Tampering with clipboard content

Two independent communication channels periodically receive and execute scripts pushed from the command‑and‑control server. Combined with process injection, kernel driver loading, and in‑memory execution, the server can continuously deliver and run additional payloads on compromised hosts.

Infection Statistics

Version comparison shows that despite changes in communication domains, interfaces, and encryption, core malicious behaviors (script delivery, terminal information harvesting, process injection) persist. Between September 15 and September 22, 2026, CNCERT observed a cumulative 700,260 infected devices in mainland China, with a daily peak of 251,880 newly checked‑in controlled endpoints.

Indicators of Compromise (IOCs)

The following artifacts can be used to detect compromised systems:

Registry Run key: JIANPIAN Registry key: SOFTWARE\JIANPIAN Service names: Jp_Update and BlackBone Installation directory and %APPDATA%\jianpianhelp\ suspicious modules

Random‑named executables in %TEMP% Periodic POST requests to jptongji.jianpiancloud.com:8002/ssl.asp on port 8002 (two cycles: 30‑minute and 20‑minute intervals)

Mitigation Recommendations

(1) Standardize Software Acquisition Channels

Avoid downloading video players from unofficial sources; verify digital signatures of installers and be wary of personally signed certificates; watch for pre‑checked bundle options during installation.

(2) Comprehensive Endpoint Scan and Cleanup

Use the IOCs above to scan registry, services, file system, and temporary directories. Treat any confirmed infected host as a controlled machine: isolate, investigate, and preferably reinstall the operating system.

(3) Block Malicious Domains and IPs

Add the listed IOCs to boundary security devices. Pay special attention to the periodic POST requests to jptongji.jianpiancloud.com:8002/ssl.asp on port 8002.

(4) Harden Endpoint Protection and Privilege Management

Enable real‑time protection in endpoint security solutions and keep virus definitions updated. Follow the principle of least privilege: do not use administrator accounts for daily work, restrict unknown programs from running with elevated rights, and promptly apply system and application security patches.

(5) Strengthen Continuous Monitoring and Auditing

Regularly inspect autostart entries, system services, processes, and network connections. Watch for anomalies such as clipboard content replacement or file association hijacking. Retain endpoint and network logs to support scope determination and forensic tracing.