Loading story…
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said TheWizards used a tool called Spellbinder to abuse IPv6 SLAAC by sending rogue ICMPv6 Router Advertisements, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as Tencent QQ and previously Sogou Pinyin fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the WizardNet backdoor, which patched AMSI and ETW, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control.
Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied Earth Minotaur to the MOONSHINE Exploit Kit and the DarkNimbus Android backdoor, while TrendAI documented PeckBirdy, a JScript-based framework used since 2023 across browsers, MSHTA, WScript, Classic ASP, Node.js, and .NET ScriptControl for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors HOLODONUT and MKDOOR. The reporting also noted infrastructure and tooling overlaps linking some of these activities to UNC3569, Earth Baxia, and supplier UPSEC, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
TrendAI published research on the previously unseen JScript-based PeckBirdy command-and-control framework and the SHADOW-VOID-044 and SHADOW-EARTH-045 campaigns that used it. The report also linked SHADOW-VOID-044 to UNC3569 with moderate-to-high confidence and SHADOW-EARTH-045 to Earth Baxia with low confidence.
ESET published research detailing the China-aligned threat actor TheWizards, its IPv6 SLAAC-spoofing adversary-in-the-middle tool Spellbinder, and the WizardNet backdoor. The report also described targeting across the Philippines, Cambodia, the UAE, mainland China, and Hong Kong, and noted links to Sichuan Dianke Network Security Technology (UPSEC).
During July 2024, researchers observed the SHADOW-EARTH-045 campaign using PeckBirdy against Asian government entities and private organizations. Activity included injecting PeckBirdy links into government websites and using MSHTA-executed PeckBirdy for lateral movement inside a private organization.
In a 2024 incident, TheWizards intercepted DNS requests for update.browser.qq.com and redirected them to 43.155.62[.]54 to hijack Tencent QQ updates. The attacker server returned JSON instructions that caused QQ.exe to download minibrowser11_rpl.zip, leading to execution of the malicious minibrowser_shell.dll and deployment of WizardNet.
ESET said TheWizards remained active through 2023 and 2024, with newer versions of its tooling observed during that period. This indicates continued development and operational use after the group's 2022 activity.
Researchers observed PeckBirdy campaigns beginning in 2023. The framework was used in operations targeting the Chinese gambling industry as well as Asian government entities and private organizations.
ESET reported that in 2022 it observed Sogou Pinyin downloading a suspicious DLL that acted as a dropper for a downloader used in TheWizards intrusions. The same year, Spellbinder used the attacker IP 43.155.116[.]7 for forged DNS responses in its hijacking activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 19 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcewelivesecurity.com
Open sourcetrendmicro.com
Open sourcevirusbulletin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Trend Micro reported on **PeckBirdy**, a lightweight **JScript-based command-and-control (C2) framework** used since at least 2023 by **China-aligned** threat actors to reduce on-disk artifacts and evade detection by leveraging Windows Script Host and runtime-injected code. The activity was tied to two intrusion sets/campaigns, **SHADOW-VOID-044** and **SHADOW-EARTH-045**, with victimology including Asian government entities, education, and the Chinese gambling sector. The framework was observed operating alongside modular backdoors **HOLODONUT** and **MKDOOR**, and in at least one campaign with commodity tooling such as **Cobalt Strike** and the use of **stolen code-signing certificates**. Trend Micro’s analysis linked SHADOW-VOID-044 infrastructure and tooling to previously reported China-aligned activity, including overlap with **UNC3569** (e.g., shared C2 domain `center[.]myrnicrosoft[.]com` and targeting of the Chinese gambling industry) and hosting of a variant of the **GRAYRABBIT** backdoor that used DLL sideloading and PowerShell execution via `UuidFromStringA`. Additional infrastructure overlaps were noted with activity associated with **TheWizard** (e.g., HOLODONUT samples communicating with `mkdmcdn[.]com`). Reported infrastructure and artifacts included IP `47[.]238[.]219[.]111`, domains `center[.]myrnicrosoft[.]com`, `mkdmcdn[.]com`, and a Cobalt Strike payload with SHA-256 `162cc325ab7b6e70edb6f4d0bc0e52130c56903f`.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026
Trend Micro disclosed that the China-aligned cluster **SHADOW-EARTH-053** compromised more than a dozen organizations in at least eight countries by exploiting vulnerable Microsoft Exchange and IIS servers, including the `ProxyLogon` chain, then deploying **GODZILLA** web shells and the **ShadowPad** backdoor to maintain access. Victims included government agencies, defense contractors, technology firms, transportation organizations, and at least one target in Poland, with activity observed from December 2024 through April 2026. Researchers said the intrusions resemble broader Chinese state-linked operations such as Salt Typhoon and Volt Typhoon and may support long-term espionage, prepositioning, and potential future disruption. Post-compromise activity included DLL sideloading with a renamed Toshiba Bluetooth Stack executable, registry-resident shellcode execution via `EnumDesktopsA` callback injection, scheduled-task persistence, mailbox collection from Exchange, credential theft, and lateral movement using tools such as **IOX**, **GOST**, **Wstunnel**, **Sharp-SMBExec**, **Mimikatz**, and **Evil-CreateDump**. Trend Micro also identified overlap with a related cluster, **SHADOW-EARTH-054**, including shared tool hashes, reused vulnerabilities, and compromises at some of the same organizations, although the company assessed the relationship as overlapping exploitation rather than clearly coordinated operations. Defenders were urged to patch Exchange and IIS systems quickly and review IIS worker process activity, web-shell indicators, and other signs of stealthy post-exploitation.
Jun 29, 2026