Budworm

Budworm, also known as APT27 and Linen Typhoon, is a China-linked cyberespionage group targeting strategically significant government and commercial organizations. Its confirmed targets include a Middle Eastern government, a U.S. state legislature, a multinational electronics manufacturer, and a hospital in Southeast Asia. Its operations have focused on Asia, the Middle East, and Europe, alongside historical and renewed targeting of U.S. organizations. Budworm exploits vulnerable internet-facing applications for initial access. It has exploited Apache Log4j vulnerabilities to compromise Apache Tomcat services and install web shells. In July 2025, it was identified as one of the China-linked actors exploiting the Microsoft SharePoint ToolShell vulnerability, CVE-2025-53770, before patching. The group's principal malware payload is HyperBro, frequently deployed through DLL sideloading using legitimate CyberArk Viewfinity software. It also uses PlugX, alternatively known as Korplug, and Cobalt Strike for post-exploitation. Its supporting tools include LaZagne for credential theft, Fscan for internal network scanning, and IOX and Fast Reverse Proxy for proxying and port forwarding. Its tradecraft combines exploitation of public-facing services, credential dumping, internal reconnaissance, and abuse of legitimate applications to load malicious payloads. Budworm uses rented virtual private servers for command-and-control infrastructure.