Silver Dragon Targets Organizations in Southeast Asia and Europe

Check Point Research has identified a Chinese-nexus advanced persistent threat group named Silver Dragon, targeting organizations in Southeast Asia and Europe since mid-2024. The group, likely operating under APT41, exploits public-facing servers and uses phishing emails for initial access. They deploy custom tools including GearDoor, a backdoor using Google Drive for command and control, SSHcmd for remote access, and SilverScreen for covert screen monitoring. Silver Dragon primarily focuses on government entities, utilizing Cobalt Strike beacons and DNS tunneling for communication. The group's sophisticated tactics and evolving toolkit demonstrate a well-resourced and adaptable threat actor.

• Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial AccessCampaign2026-10-26
• PIVOTPIPE: A New .NET-based Unofficial Beacon PayloadMalware2026-09-16
• Melofee: a look back at a Linux implant and its new variantsMalware2026-09-10
• Palo Alto Networks PAN-OS · Operation Master: Deconstructing a Multi-Tiered Intrusion and Monetization PipelineExploitedMalware2026-09-28
• In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis2026-10-23