CampaignPublished 18 May 2026

Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor

Source AlienVault OTX General

Description

Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.

Impact

The campaign enables remote access and control of compromised systems through a modular .NET-based RAT, potentially allowing the adversary to perform reconnaissance, persistence, and data exfiltration. The use of legitimate binaries alongside malicious DLLs may help evade detection and facilitate stealthy operations. While the campaign is active, there is no evidence of widespread exploitation or public exploits. The impact is medium severity given the remote access capabilities and targeted nature of the campaign.

Defensive guidance

Organizations should monitor for indicators of compromise such as connections to suspicious domains like www.icloud-cdn.net and the presence of known malicious file hashes. Detection and blocking of DLL sideloading techniques and unusual execution patterns related to .NET binaries may help mitigate risk. Follow vendor advisories and threat intelligence updates for any future patches or mitigation recommendations.

Summary

This campaign, attributed to the Chinese APT group Twill Typhoon, leverages an updated FDMTP backdoor to compromise targets by sideloading malicious DLLs alongside legitimate binaries. The attackers use domains impersonating well-known CDNs to facilitate the delivery of their payloads. The backdoor is a modular .NET-based RAT that enables remote access and control of compromised systems. The campaign was first observed in late September 2025 and involves sophisticated techniques such as DLL sideloading to evade detection. Indicators include a domain (www.icloud-cdn.net) and multiple file hashes associated with the malicious components.

Indicators of compromise

Domains 1

www.icloud-cdn.net

Hashes 11

067fbad4d6905d6e13fdc19964c1ea52
162f69fe29eb7de12b684e979a446131
2cd781ab63a00ce5302ed844cfbecc27
482cc72e01dfa54f30efe4fefde5422d
b2c8f1402d336963478f4c5bc36c961a
c17f39d25def01d5c87615388925f45a
df3437c88866c060b00468055e6fa146
fc3959ebd35286a82c662dc81ca658cb
8a1f2f9baa900ab09dbfed7714948cdf9cbbf50bSHA1 of b2c8f1402d336963478f4c5bc36c961a
0bb1e7190c781ce5dd02304511604c225f0b1b5efe9c62583971266ef0b4ff3aSHA256 of b2c8f1402d336963478f4c5bc36c961a

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 May 2026, 19:52 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 11

Community reviews

Related threats