MalwarePublished 3 Nov 2025

Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks

Source SecurityWeek

Description

PowerShell and .NET variants of the malware abuse AirWatch’s MDM API to establish a C&C communication channel. The post Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks appeared first on SecurityWeek .

Impact

For European organizations, the ‘Airstalk’ malware poses a significant risk to confidentiality and integrity due to its stealthy command and control channel established via AirWatch’s MDM API. Organizations relying on AirWatch for managing mobile devices and endpoints could experience unauthorized data access, espionage, or manipulation of device configurations. The supply chain attack vector increases the likelihood of widespread infiltration, potentially affecting multiple organizations simultaneously. Critical sectors such as finance, government, telecommunications, and manufacturing are at heightened risk due to the strategic value of their data and infrastructure. The malware’s ability to operate without user interaction and evade traditional detection mechanisms complicates incident response and remediation efforts. Disruption to device management services could also impact availability indirectly by impairing IT operations. Overall, the threat could lead to intellectual property theft, regulatory compliance violations, and erosion of trust in supply chain partners, with cascading effects on European digital resilience.

Defensive guidance

To mitigate the ‘Airstalk’ threat, European organizations should implement enhanced monitoring of AirWatch MDM API usage, focusing on detecting anomalous or unauthorized access patterns that could indicate covert C&C activity. Enforce strict access controls and least privilege principles for MDM API credentials, including regular credential rotation and multi-factor authentication where supported. Conduct thorough supply chain risk assessments and audits of third-party vendors and software update mechanisms to identify potential compromise points. Deploy endpoint detection and response (EDR) solutions capable of identifying suspicious PowerShell and .NET activity related to device management processes. Establish network segmentation to isolate management infrastructure and limit lateral movement opportunities. Maintain up-to-date threat intelligence feeds to recognize emerging indicators of compromise associated with this malware. Finally, conduct regular security awareness training for IT administrators managing MDM platforms to recognize and respond to unusual system behaviors promptly.

References

securityweek.com/chinese-apt-uses-airstalk-malware-in-supply-chain-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Nov 2025, 10:28 UTC

References

Community reviews