← News
/DISPATCH · 2026-10-09

CNCERT: Jianpian Player backdoor infects 700,260 devices in China

CNCERT said the Windows Jianpian Player contains a built-in backdoor and has infected 700,260 devices in China. Daily online controlled endpoints peaked at 251,880 between 15 and 22 September 2026.

Warning

The National Computer Network Emergency Response Technical Team/Coordination Center of China (CNCERT) reported that the Windows Jianpian Player, offered from www.jianpian.com, contains a built-in backdoor. That site is not a legally registered website in China. The application can collect endpoint data, download and run other programs, and execute server-issued code without user consent. Stated risks include remote control of the host and exposure of personal information. CNCERT has recorded more than 700,000 infected devices in China.

Scope of the sample

The analysis covers the Windows player distributed as the so-called official Jianpian video client. The program provides video playback while remaining resident through a registry Run key and a Windows service. Version comparisons showed changes to command-and-control domains, interfaces, and encryption. Host data collection, script execution, and process injection remained.

Components cited for identification include jianpian.exe (32-bit launcher), jianpianer.dll (32-bit core library), jianpianhelp.dll (64-bit unsigned script module with an invalid all-F file timestamp), Jp_Update.exe (64-bit update service), and FileSuite.exe (32-bit media-association tool that requires administrator rights).

Persistence cited for hunting includes the Run value JIANPIAN under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run, related StartupApproved\Run handling, and a boot-start service named Jp_Update.

Impact

CNCERT said the core library can pull remote configuration (primary domain jianpiancloud.com, backup jphwapi.com, later jpcloud.org) and silently install third-party software chosen by the server. Installers are written under %TEMP% with random names and started with elevated rights and a hidden window.

The same library builds a host fingerprint from the C: volume serial number and the first physical Ethernet MAC address, skipping adapters whose names contain virtual. The value is stored at HKEY_LOCAL_MACHINE\SOFTWARE\JianPianPlayer\PCCode and reported to a statistics interface. Local storage under wkeStorage holds campaign, channel, referrer, and install-time data.

Two independent channels contact statistics servers on roughly 30-minute and 20-minute cycles. Server responses can be executed as code on the host. The update service also supports in-memory program execution, process injection, and runtime loading of a kernel driver.

Further impact includes replacement of copied HTTP and FTP links on the clipboard, rewriting default handlers for 36 media formats including UserChoice, and advertisement windows whose content and timing come from the configuration service. An embedded browser exposes local interfaces that can write files, create components, trigger downloads, and read the host fingerprint.

Deleted modules can be restored from a repair URL. Callback domains can be changed through registry values under HKEY_CURRENT_USER\SOFTWARE\JIANPIAN. Newer builds moved callbacks to HTTPS, shifted control infrastructure to the jpcloud.org domain family, bundled libcurl, and added an encrypted traffic tunnel. Hidden autostart, silent installs, fingerprinting, clipboard hijacking, script execution, and process injection were still present. Script-channel versions observed in URLs include 1.2.3.30, 4.0.1, and 5.0.0.1.

Infection counts

From 15 through 22 September 2026, CNCERT counted 700,260 infected devices in China. The daily number of online controlled endpoints peaked at 251,880.

Recommended actions

Obtain media players only from known sources. Check the digital signature on installers and watch for pre-checked bundle options.

Hunt the Run value JIANPIAN, keys under SOFTWARE\JIANPIAN, the Jp_Update service, BlackBone-related artifacts, the install directory, modules under %APPDATA%\jianpianhelp\, and random-name executables in %TEMP%. Treat confirmed hosts as compromised. Isolate them and consider a full operating system reinstall.

Block the listed indicators on perimeter devices. Watch periodic POST requests to port 8002 and to ssl.asp or ssl.php paths on 30-minute and 20-minute intervals.

Keep endpoint protection enabled with current signatures. Do not use an administrator account for daily work. Restrict unknown programs from running as administrator. Apply operating system and application patches.

Review autostart entries, services, processes, and network connections. Note clipboard replacement and file-association changes. Keep host and perimeter logs for scoping.

Indicators of compromise

Sample SHA256 hashes:

IP addresses: 45.117.8[.]37, 45.120.103[.]111, 34.150.19[.]222.

Domains: jptongji.jianpiancloud[.]com, jianpiantongji.x-app[.]one, pconfig.jianpiancloud[.]com, media.jianpiancloud[.]com, web.jianpiancloud[.]com, jphwapi[.]com, pchwjiasu.abkc4[.]com, pchwjiasu.arykoyq[.]com, jptongji.jpcloud[.]org, pconfig.jpcloud[.]org, media.jpcloud[.]org, web.jpcloud[.]org, www.jpcloud[.]org.

URLs reported by CNCERT include:

Acknowledgments

CNCERT credited Venustech VenusEye Threat Intelligence Center and Zhongfu Security Yuanheng Laboratory for sample analysis.