apt24

APT24, also known as Pitty Panda and G0011, is a China-nexus espionage threat actor active since at least 2011 and commonly assessed as aligned with People’s Republic of China intelligence objectives. The group has been associated with long-running cyberespionage operations that evolved from watering-hole and web-compromise activity into broader multi-vector intrusion campaigns, including targeted phishing, social engineering, and supply-chain compromise. APT24 has notably targeted organizations in Taiwan and has also been reported targeting entities in the United States. Reported operations include compromise of public-facing websites to inject malicious JavaScript that presents fake software-update lures to Windows users, as well as compromise of a regional digital marketing firm to facilitate downstream supply-chain attacks across a large set of customer-linked domains. The actor has also conducted highly targeted phishing campaigns using themed lures and has abused legitimate cloud storage services to distribute encrypted archives containing malware. A malware family prominently associated with APT24 is BADAUDIO, a downloader used in a multi-year espionage campaign. BADAUDIO performs host reconnaissance, gathers basic system-identifying information, encrypts collected data, communicates over HTTP, and can retrieve and execute follow-on payloads. Public analysis has also highlighted APT24’s use of practical defense-evasion measures such as string obfuscation, encrypted communications, and blending malicious traffic with legitimate cloud-hosted infrastructure. Broader reporting characterizes the group’s tradecraft as adaptive and persistent, combining web compromises, spearphishing, supply-chain access, and stealth-oriented delivery techniques in support of intelligence collection.