Loading story…
Researchers linked the SideWalk backdoor to multiple China-aligned intrusion sets tied to the broader APT41/Winnti ecosystem, with Symantec attributing recent activity to Grayfly and earlier ESET reporting associating the malware with SparklingGoblin. Recent intrusions hit organizations in Taiwan, Vietnam, the United States, and Mexico, with a strong focus on telecommunications as well as IT, media, finance, academia, and government targets. Investigators said attackers gained access by exploiting exposed Microsoft Exchange and MySQL servers, then deployed web shells, established persistence with scheduled tasks, and stole credentials using a custom Mimikatz variant.
Technical analysis showed SideWalk is a modular backdoor closely related to CROSSWALK, reinforcing assessments of shared developers or operational overlap inside the APT41 ecosystem. ESET found the malware could retrieve infrastructure through Google Docs dead-drop resolvers and use Cloudflare Workers for command-and-control, while TeamT5 later documented a related China-nexus backdoor, Calendarwalk, that used Google Calendar events for C2 and was deployed against Taiwanese IT and ERP organizations in 2024 and 2025. Calendarwalk also used a multi-stage chain involving Windows Workflow Foundation XOML, shellcode loaders, and heavy obfuscation, underscoring a broader pattern of Chinese espionage operators adopting stealthy, cloud-backed malware families for long-term post-compromise access.
TTPs, infrastructure, and targeting history in one profile.
12 events from the most recent confirmed update back to the earliest known activity.
At the Virus Bulletin Conference in September 2025, TeamT5 presented research on Calendarwalk, a newly identified backdoor using Google Calendar as command-and-control infrastructure. The researchers attributed the malware to the China-nexus group Amoeba, also known as APT41 or Earth Baku, and said it had been deployed against Taiwanese victims in 2024 and 2025.
In December 2024, TeamT5 identified two fully undetected samples exploiting Windows Workflow Foundation XOML to execute payloads. One payload was an AES variant of Chatloader, while the other was the previously unseen Calendarwalk backdoor.
TeamT5 found Google Calendar events timestamped 2023-05-30 used for victim information and events timestamped 2023-07-30 used to deliver commands in Calendarwalk operations. Decrypted event data showed the attacker attempted to execute the "query user" command and received victim reporting from a Taiwanese IT company host.
ESET reported that SparklingGoblin deployed a Linux variant of the SideWalk backdoor against a Hong Kong university in February 2021, extending an intrusion at the same institution that began in May 2020. ESET also concluded that the malware previously called StageClient, and the previously documented Specter RAT, are Linux variants of SideWalk.
In May 2020, ESET observed a campaign targeting a previously compromised Hong Kong university using the CROSSWALK backdoor and a PlugX variant that used Google Docs as a dead-drop resolver. ESET began tracking the post-2019 activity as a separate actor that it later named SparklingGoblin.
Symantec noted that three Chinese nationals tied to Chengdu 404 were indicted by the United States in 2020 for attacks involving Grayfly tools and tactics. The report said the group nevertheless appears to have remained active.
ESET telemetry indicates SparklingGoblin was very active from mid-2020 through 2021, targeting victims across academia, government, media, and commercial sectors in Asia and elsewhere. Reported targets included organizations in Macao, Hong Kong, Taiwan, Southeast Asia, South Korea, Canada, India, Bahrain, the USA, and Georgia.
ESET previously observed a Winnti Group campaign starting in late October 2019 that targeted several Hong Kong universities. The operation used ShadowPad, Winnti malware, Spyder, and a DarkShell-based backdoor ESET named Doraemon.
Symantec said the China-linked espionage group Grayfly, also known as GREF and Wicked Panda, has been active since at least March 2017. The group historically used tools including the CROSSWALK backdoor and a custom loader called Chattak.
Symantec said Grayfly's more recent activity concentrated on telecommunications organizations while also affecting IT, media, and finance targets. The intrusions involved exploitation of exposed Microsoft Exchange or MySQL servers, web shell deployment, Sidewalk execution, and credential theft using a custom Mimikatz variant.
Symantec attributed the Sidewalk backdoor to Grayfly and linked it to the older CROSSWALK malware family. The company assessed Grayfly as the espionage arm of APT41 and said the malware was used in recent campaigns against organizations in Taiwan, Vietnam, the United States, and Mexico.
ESET researchers documented a previously unknown modular backdoor named SideWalk and attributed it to the APT cluster SparklingGoblin. The report said SideWalk had been used in a campaign targeting a US-based computer retail company and shared significant similarities with the older CROSSWALK backdoor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
5 references tracked. Mallory keeps watching after this page renders.
symantec-enterprise-blogs.security.com
Open sourcevirusbulletin.com
Open sourcewelivesecurity.com
Open sourcewelivesecurity.com
Open sourceblog.netlab.360.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Cisco Talos identified **UAT-11587**, a China-nexus espionage cluster active from at least September 2025 through July 2026, targeting government, security, diplomatic, legislative, policy, academic and civil-society organizations across Asia. The campaign targeted or affected at least 16 institutional environments and roughly 350 endpoints in Taiwan, India, the Philippines, Cambodia, Pakistan, Thailand, Myanmar and Syria. The group used tailored spear-phishing, sender spoofing and topical decoys, including fake Gmail attachment widgets, to deliver a previously undocumented Rust-based Windows backdoor named **Antino**. Cloudflare-hosted infrastructure supported payload staging, victim tracking and delivery of HTA or WSF stagers; the multi-stage chain decrypted loaders in memory, abused .NET `BinaryFormatter` gadget chains, and DLL-side-loaded Antino via Microsoft-signed `GatherOsState.exe`. Antino enables reconnaissance, command and PowerShell execution, file transfer, in-memory shellcode loading and Registry Run-key persistence, while using Microsoft Graph as dead-drop C2 by polling Outlook for commands and OneDrive for telemetry, payload distribution and exfiltration, helping its traffic blend with legitimate Microsoft 365 activity.
Oct 2, 2026