ChinaAssessedChinese state-sponsoredMixedActive 2012 – 2025Double Dragon
Also known asBARIUM · Brass Typhoon · Wicked Panda · Earth Baku · Earth Freybug · Earth Longzhi · Bronze Atlas · Red Kelpie · Grayfly · TA415
Summary
China's dual-mission APT — state-sponsored espionage (MITRE) plus financial cybercrime simultaneously. ShadowPad is their primary RAT, shared across China's intel community. Five members indicted by DoJ September 2020; all remain at large in PRC. Late October 2024: Google Calendar used as C2 for TOUGHPROGRESS malware delivered from a compromised government site (GTIG, May 2025); Jul–Aug 2025: TA415 phishing campaigns (Proofpoint). C0040 DUST campaign ran Jan 2023–Jul 2024. Increased operational tempo in Q1 2025 vs prior quarters. Targets 40+ industries in 40+ countries; largest, most diverse malware arsenal of any PRC-nexus group including UEFI firmware implants, supply chain injection, cross-platform backdoors, and mobile surveillance tooling. June 2025: Microsoft and CrowdStrike unified taxonomy confirmed APT41 = Brass Typhoon = Wicked Panda = Winnti.
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- MITRE ATT&CK (MITRE ATT&CK, 2026-10)
Assessed Chinese state-sponsored, also financially motivated - US Department of Justice (Government, 2020-09-16)
Indicted members ran Chengdu 404 Network Technology, a PRC company
Campaigns 5
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| BlackX UEFI bootkit (BlackLotus-derived, Baton Drop) against diplomatic agencies in Tajikistan, Uzbekistan and TurkmenistanASSESSED | 2026 | Tajikistan, Uzbekistan, Turkmenistan | Diplomatic | Kaspersky GReAT (2026-10-22) — APT41, medium confidence |
| TA415 US–China economic-policy spearphishing (VS Code Remote Tunnels) | 2025-07 – 2025-08 | USA | Government, Think Tanks, Academia | Proofpoint (2025-09-16) |
| Taiwan critical-infrastructure targeting (NSB 2025 annual assessment) | 2025 | Taiwan | Energy, Healthcare, Communications, Government, Technology | Taiwan National Security Bureau, 'Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025' (2026-01-04) |
| TOUGHPROGRESS — Google Calendar C2 via exploited government site | 2024-10 | Government entities (multiple) | Government | Google Threat Intelligence Group (2025-05-28) |
| Global Shipping/Logistics & Media Compromise — DUSTPAN/DUSTTRAP | 2023 – 2024-07 | Italy, Spain, Taiwan, Thailand, Turkey, UK | Shipping/Logistics, Media/Entertainment, Technology, Automotive | Mandiant / Google TAG (2024-07-18) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
| Initial Access2 | T1190Exploit Public-Facing ApplicationT1195Supply Chain Compromise |
|---|---|
| Execution1 | T1059.001PowerShell |
| Persistence2 | T1078Valid AccountsT1505.003Web Shell |
| Stealth2 | T1055Process InjectionT1574.001DLL |
| Credential Access1 | T1003OS Credential Dumping |
| Command and Control2 | T1102.002Bidirectional CommunicationT1219.001IDE Tunneling |
Malware and tools 14
| Name | Description | Platform |
|---|---|---|
| ShadowPad | Modular RAT | Windows |
| PlugX | Modular RAT | Windows |
| KeyPlug | Backdoor | Windows/Linux |
| CROSSWALK | Modular Backdoor | Windows |
| Cobalt Strike | Post-exploitation | Windows/Linux |
| DUSTPAN | Loader | Windows |
| DUSTTRAP | In-memory Backdoor | Windows |
| MOONWALK | Backdoor | Linux |
| TOUGHPROGRESS | Backdoor (Google Calendar C2) | Windows |
| PLUSDROP | Dropper (in-memory) | Windows |
| PLUSINJECT | Injector (process hollowing) | Windows |
| WhirlCoil | Loader (Python) | Windows |
| LightSpy | Malware | Android/Windows/iOS/macOS |
| MOPSLED | Malware | Linux |
Exploited vulnerabilities 9
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4Shell (KEV 2021-12-10) |
| CVE-2019-19781 | 9.8 | Citrix ADC (KEV 2021-11-03) |
| CVE-2019-3396 | 9.8 | Atlassian Confluence Widget Connector — template injection RCE (KEV 2021-11-03) |
| CVE-2020-10189 | 9.8 | Zoho ManageEngine Desktop Central — deserialization RCE (KEV 2021-11-03) |
| CVE-2021-26855 | 9.1 | Exchange ProxyLogon (KEV 2021-11-03) |
| CVE-2012-0158 | 8.8 | Microsoft Windows Common Controls (MSCOMCTL.OCX) — RCE (KEV 2021-11-03) |
| CVE-2015-1641 | 7.8 | Microsoft Word — memory corruption RCE (KEV 2021-11-03) |
| CVE-2017-0199 | 7.8 | Microsoft Office/WordPad — RTF/HTA RCE (KEV 2021-11-03) |
| CVE-2017-11882 | 7.8 | Microsoft Office Equation Editor — memory corruption RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Google Sheets, Google Calendar and VS Code Remote Tunnels as C2, as TA415 (Proofpoint, 2025)
- Domain-generation algorithms rotate its C2 servers monthly (MITRE ATT&CK, 2026)
Reporting and advisories 7
- DoJ
Indictment — Five APT41 Members (2020) - Mandiant / Google TAG
Global Shipping/Logistics & Media Compromise — DUSTPAN/DUSTTRAP - Google Threat Intelligence Group
TOUGHPROGRESS — Google Calendar C2 via exploited government site - Proofpoint
TA415 US–China economic-policy spearphishing (VS Code Remote Tunnels) - MITRE ATT&CK
Double Dragon (G0096) group profile - Kaspersky GReAT
How APT41 revived the BlackLotus bootkit (BlackX) (22 Oct 2026) - Taiwan National Security Bureau
Analysis on China's Cyber Threats to Taiwan's Critical Infrastructure in 2025 (4 Jan 2026)