Loading story…
Researchers disclosed a previously undocumented backdoor dubbed Yokai that targeted Thai officials through a DLL side-loading chain built around the legitimate iTop Data Recovery executable IdrInit.exe. The intrusion began with RAR archives containing Thai-language .lnk decoys that abused alternate data streams and the LOLBin esentutl to rebuild benign-looking documents while extracting a malicious dropper. That dropper wrote files to C:\ProgramData\police, including IdrInit.exe and the rogue ProductStatistics3.dll, then launched the executable so the DLL would be side-loaded. Yokai established persistence with a scheduled task named MicrosoftTSUpdate, used the mutex Mutex_Local_Windows_1547, and checked in over HTTP with XOR-encrypted traffic before accepting commands such as spawning cmd.exe and executing shell instructions through pipes.
The campaign reflects tradecraft seen across China-linked espionage operations that rely on stealthy loaders, side-loading, and living-off-the-land techniques to evade detection. ESET previously documented Evasive Panda using DLL side-loading, scheduled tasks, and trojanized software to target Tibetans with backdoors including Nightdoor and MgBot, while Mandiant described APT41 malware families such as DUSTPAN and DUSTTRAP using staged in-memory execution, deceptive Windows service persistence, and temporary DLL trojanization to bypass EDR. In the Yokai case, the use of esentutl—a known LOLBAS utility—underscores how legitimate Windows components continue to be repurposed to conceal malware delivery and execution in targeted government-focused intrusions.
See the actors and campaigns active against you right now.
10 events from the most recent confirmed update back to the earliest known activity.
ESET reported that a cyberespionage campaign attributed to Evasive Panda had targeted Tibetans and related entities since at least September 2023. The activity used watering hole and supply-chain compromises to deliver malware.
Mandiant reported that activity involving IP address 152.89.244[.]185, including the URL hxxp://152.89.244[.]185/conn.exe used to deliver DUSTPAN, was first observed on 2023-03-21. This provides an earlier dated anchor for infrastructure associated with APT41's later documented DUSTPAN activity.
Mandiant noted that APT41 also used DUSTPAN in several breaches in 2022. The malware was used to decrypt and execute payloads in memory and support persistence through Windows services.
Mandiant said APT41 previously used the DUSTPAN in-memory dropper in several breaches during 2021 and 2022. Those earlier intrusions form the historical backdrop for the malware family's later reappearance.
Netskope analyzed a previously undocumented backdoor and named it Yokai based on YK strings found in variant PDB paths. The malware was delivered through a DLL side-loading chain abusing the legitimate iTop Data Recovery executable IdrInit.exe.
Mandiant described DUSTTRAP as a multi-stage modular plugin framework used by APT41, including a launcher tied to the victim MachineGUID and an evasion method that briefly trojanizes legitimate DLLs before restoring them on disk. The report also detailed its staged plugins for networking and additional functionality.
Mandiant reported that DUSTPAN resurfaced in a recent APT41 investigation. In the observed activity, DUSTPAN loaded ChaCha20-encrypted BEACON payloads that communicated through infrastructure behind Cloudflare or via Cloudflare Workers.
ESET requested that the Google account associated with Nightdoor's Google Drive command-and-control channel be taken down. The account was tied to the campaign's use of OAuth tokens for C2.
After ESET notified Apple, the developer certificate used to sign the campaign's macOS malware was revoked. This was part of the response to the supply-chain activity targeting Tibet-related victims.
ESET disclosed a campaign in which Evasive Panda compromised the Kagyu International Monlam Trust website and a Tibetan software developer's supply chain to deliver MgBot and a newly documented backdoor, Nightdoor. The campaign targeted users in multiple countries and used Google Drive for Nightdoor command and control.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 146 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
netskope.com
Open sourcecloud.google.com
Open sourcecloud.google.com
Open sourcewelivesecurity.com
Open sourcelolbas-project.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **DragonOK** espionage group was linked to a renewed wave of targeted intrusions against organizations in Japan and other parts of Asia, using updated malware families including **PlugX** variants, **Sysget**, **IsSpace**, and **TidePool**. Researchers tied a PlugX variant known as **PIPX** to DragonOK through overlapping command-and-control infrastructure, domain registration patterns, and tradecraft previously associated with the group. The activity primarily targeted manufacturing and high-tech organizations in Japan and Taiwan, while related reporting also identified likely victims in Tibet and Russia. The attacks used phishing emails, malicious executables, and weaponized RTF documents exploiting **`CVE-2015-1641`**, alongside techniques such as **DLL sideloading**, code injection into **`nslookup.exe`**, and persistence through services, autorun registry keys, and PowerShell-based registry changes. DragonOK’s newer tooling showed stronger encryption, anti-debugging and anti-VM protections, altered command-and-control communications, and an unusual method of storing encrypted payloads in registry values such as **`HKLM\SOFTWARE\BINARY`** or **`HKCU\SOFTWARE\BINARY`** instead of loading directly from disk. The combined reporting indicates the group was actively refining its malware and broadening operations while maintaining a strong focus on Japanese targets.
Aug 15, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
Elastic analyzed a spearphishing operation targeting Malaysian government officials with a malicious Word document themed around Malaysia's 2020 political crisis. The document remotely loaded a VBA template that wrote DLL payloads to disk, downloaded Logitech's legitimate `LogiMailApp.exe`, and exploited DLL side-loading by placing a malicious `LogiMail.dll` beside it for execution. The backdoor retrieved and decrypted a second-stage implant in memory, enabling host reconnaissance, command execution, file transfers, Registry Run-key persistence, and AES-encrypted command-and-control through dynamic-DNS infrastructure. Elastic linked the activity with moderate confidence to the China-nexus APT40/Leviathan group, citing overlaps in strings, URLs, functionality, and tactics with indicators previously published by MyCERT; DLL side-loading is a widely used execution and defense-evasion technique tracked as MITRE ATT&CK `T1574.001`.
Sep 9, 2026