Loading story…
China-linked threat actor APT24 has conducted a multi-year espionage campaign targeting organizations in Taiwan and other sectors using a previously undocumented malware called BADAUDIO. The group, also known as Pitty Tiger, shifted from broad web compromises to more sophisticated attack vectors, including repeated compromises of a regional digital marketing firm to execute supply chain attacks. By injecting malicious JavaScript into widely used libraries distributed by the marketing firm, APT24 was able to compromise over 1,000 domains, enabling targeted delivery of the BADAUDIO malware. The campaign also leveraged spearphishing emails, often impersonating animal rescue organizations, and watering hole attacks to deliver the malware, with a focus on Windows systems.
Researchers from Google Threat Intelligence Group (GTIG) and independent security outlets have detailed how APT24's tactics evolved over time, including the use of fake software update pop-ups and the registration of domains impersonating legitimate CDNs to facilitate malware delivery. The attackers used fingerprinting scripts to identify high-value targets and selectively deployed the next-stage payload. The campaign demonstrates a high level of operational sophistication, persistence, and adaptability, with APT24 exploiting both supply chain vulnerabilities and social engineering to maintain access to sensitive networks in Taiwan and beyond.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
Google Threat Intelligence Group disclosed the BadAudio malware and described its use in a years-long APT24 espionage campaign targeting Windows systems, especially organizations in Taiwan. The disclosure detailed techniques including DLL hijacking, encrypted payload delivery, reconnaissance, and data exfiltration.
Researchers said the malicious JavaScript campaign on more than 20 public websites remained active until September 2025. The prolonged activity demonstrated the persistence of APT24's BadAudio delivery infrastructure.
Beginning in August 2024, APT24 used spear-phishing emails spoofing an animal rescue organization to deliver BadAudio-related payloads. The phishing activity complemented the group's website and supply-chain infection methods.
Starting in July 2024, APT24 compromised a regional digital marketing firm in Taiwan and used that access to scale malware delivery through more than 1,000 compromised domains. This marked a shift from broader web compromises toward more targeted supply-chain operations.
APT24 started using malicious JavaScript injected into public websites to show fake software-update pop-ups that delivered the BadAudio malware. Reporting places this activity beginning in November 2022 and continuing for years as part of a cyber-espionage campaign.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
7 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A Chinese state-linked hacking group tracked as **APT10** was tied to a months-long supply-chain intrusion against Taiwan’s financial sector, compromising organizations through an undisclosed flaw in the web administration interface of a widely used securities software product. Researchers said the affected platform reportedly serves more than **80%** of Taiwan’s local financial organizations, giving the attackers broad downstream access. The campaign, tracked as **Operation Cache Panda**, was disguised in part as credential-stuffing activity while targeting brokerage data, personally identifiable information, and the ability to disrupt investment operations rather than steal funds directly. After initial access, the attackers uploaded the **ASPXCSharp** web shell to control exposed servers, used **Impacket** to scan internal networks, and moved laterally with **Remote Service** creation and **WMI**. They then deployed a **Quasar RAT** variant and other .NET payloads through reflective in-memory loading using tooling associated with **Donut** and **SharpSploit**, reducing on-disk artifacts and antivirus detection. Investigators also found the group established reverse-tunnel **RDP** access for persistent interactive control and used the Chinese cloud file-sharing service **WenShuShu** to retrieve tools during the operation.
Aug 15, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
A China-linked advanced persistent threat (APT) group infiltrated a U.S. non-profit organization focused on influencing U.S. government policy on international issues, maintaining access for several weeks in April 2025. The attackers initiated their campaign with mass scanning on April 5, targeting a server using multiple public exploits, including those for Log4j, Atlassian OGNL, Apache Struts, and GoAhead Web Server. After a brief pause, activity resumed on April 16 with connectivity tests and network reconnaissance, followed by the establishment of persistence through a scheduled task that executed `msbuild.exe` as SYSTEM every hour. This task likely injected code into `csc.exe`, which then communicated with a command-and-control server at `38.180.83[.]166`. The attackers also used DLL sideloading via the legitimate VipreAV component `vetysafe.exe` to load a malicious DLL (`sbamres.dll`), a technique previously associated with other Chinese APT groups. The intrusion demonstrated a focus on stealth and long-term access, with the use of legitimate binaries and scheduled tasks to evade detection. The attackers' tactics, including the use of `Imjpuexc` (a Microsoft file for East Asian input) to mask activity and the deployment of a custom loader to execute an encrypted payload (likely a remote access trojan) in memory, align with methods seen in other campaigns attributed to Chinese state-sponsored actors. The operation is part of a broader pattern of Chinese cyber-espionage targeting U.S. organizations involved in policy matters, leveraging both legacy and recent vulnerabilities to gain initial access and maintain persistence within high-value networks.
Jun 29, 2026