This campaign, attributed to the Chinese APT group Twill Typhoon, leverages an updated FDMTP backdoor to compromise targets by sideloading malicious DLLs alongside legitimate binaries. The attackers use domains impersonating well-known CDNs to facilitate the delivery of their payloads. The backdoor is a modular .NET-based RAT that enables remote access and control of compromised systems. The campaign was first observed in late September 2025 and involves sophisticated techniques such as DLL sideloading to evade detection. Indicators include a domain (www.icloud-cdn.net) and multiple file hashes associated with the malicious components. No CVE or patch information is available, and no known exploits in the wild have been reported.

The campaign enables remote access and control of compromised systems through a modular .NET-based RAT, potentially allowing the adversary to perform reconnaissance, persistence, and data exfiltration. The use of legitimate binaries alongside malicious DLLs may help evade detection and facilitate stealthy operations. While the campaign is active, there is no evidence of widespread exploitation or public exploits. The impact is medium severity given the remote access capabilities and targeted nature of the campaign.

No official patch or remediation guidance is currently available for this campaign. Organizations should monitor for indicators of compromise such as connections to suspicious domains like www.icloud-cdn.net and the presence of known malicious file hashes. Detection and blocking of DLL sideloading techniques and unusual execution patterns related to .NET binaries may help mitigate risk. Follow vendor advisories and threat intelligence updates for any future patches or mitigation recommendations.