Silver Dragon

Silver Dragon is a Chinese-aligned cyberespionage activity cluster assessed by Check Point Research to be operating under the broader APT41 umbrella, active since at least mid-2024. The group has targeted organizations across Southeast Asia and Europe, with a particular focus on government and public-sector/high-profile entities. Initial access has been observed via exploitation of public-facing internet servers and via phishing emails with malicious attachments (including weaponized LNK files, with documented targeting of government entities in Uzbekistan). Across multiple observed intrusion chains, Silver Dragon rapidly deploys Cobalt Strike beacons (noted as cracked variants with multiple watermark values) and uses multiple C2 methods including DNS tunneling, HTTP (often behind Cloudflare), and SMB for intra-network communications. Check Point described three primary infection chains that culminate in Cobalt Strike delivery: (1) AppDomain hijacking (e.g., abusing dfsvc.exe and also tzsync.exe) using .NET loaders such as MonikerLoader (with Brainfuck-based string decryption and in-memory reflective loading of a second-stage loader); (2) service DLL hijacking/persistence by impersonating and hijacking legitimate Windows services via registry/service manipulation (abusing services including wuausrv, bthsrv, COMSysAppSrv, DfSvc, and tzsync) and deploying a heavily obfuscated C++ shellcode loader dubbed BamboLoader (RC4 decryption, LZNT1 decompression via RtlDecompressBuffer, and injection into processes such as taskhost.exe/taskhostw.exe); and (3) LNK-based phishing that uses PowerShell extraction and DLL sideloading (e.g., via a legitimate executable GameHook.exe) to load BamboLoader and an encrypted Cobalt Strike payload while presenting a decoy document. Post-compromise tooling attributed to Silver Dragon includes GearDoor (a .NET backdoor using Google Drive as a file-based C2 channel, with per-victim folders and tasking/results exchanged via files whose extensions encode actions; communications encrypted with DES using a key derived from an MD5-based scheme), SilverScreen (periodic screenshot capture with change detection and compression), and SSHcmd (a .NET SSH utility leveraging Renci.SshNet for remote command execution and file transfer). Reporting also notes Silver Dragon’s tradecraft overlaps with APT41 (including similarities to installation scripts previously documented by Mandiant) and compilation timestamps aligning with UTC+8 as supporting evidence for the China nexus.