Full Report
Researchers at Darktrace disclosed a China-linked cyberespionage campaign targeting organizations primarily across the Asia-Pacific and Japan region using... The post Twill Typhoon used legitimate Windows tools, DLL sideloading, FDMTP backdoor in APAC espionage campaign appeared first on Industrial Cyber.
Analysis Summary
# Threat Actor: Twill Typhoon
## Attribution & Identity
* **Actor Name:** Twill Typhoon
* **Affiliation:** China-linked / China-nexus group.
* **Known Associations:** Darktrace assesses with moderate confidence that this campaign aligns with Twill Typhoon tradecraft. It shares operational patterns with other China-linked activities such as the "Crimson Echo" cluster.
## Activity Summary
Darktrace disclosed a cyberespionage campaign active from late September 2025 through October. The campaign utilized a modular intrusion chain characterized by the staged delivery of payloads. Attackers leveraged infrastructure designed to impersonate legitimate Content Delivery Networks (CDNs) to trick targets into downloading malicious components used to deploy the FDMTP backdoor.
## Tactics, Techniques & Procedures
* **DLL Sideloading:** Using legitimate binaries to load malicious DLLs (T1574.002).
* **Search-Order Hijacking:** Frequently used to gain execution within legitimate processes.
* **System Profiling:** Collecting host information via the backdoor.
* **Persistence:** Achieved through registry modifications (T1112) and the creation of Scheduled Tasks (T1053.005).
* **Impersonation:** Utilizing infrastructure that mimics legitimate platforms like Yahoo and Apple.
* **Living off the Land (LotL):** Heavy reliance on legitimate Windows components, including ClickOnce and Visual Studio hosting processes.
* **Staged Sequence of Intrusion:**
1. Retrieval of a legitimate executable.
2. Retrieval of a matching `.config` file.
3. Retrieval of the malicious DLL.
4. Repeated DLL updates over time.
5. C2 communication.
## Targeting
* **Sectors:** Critical infrastructure and various organizations requiring modular intrusion chains (general APAC/Japan entities).
* **Geography:** Primarily Asia-Pacific (APAC) and Japan.
* **Victims:** Darktrace identified multiple customer environments affected, though specific company names were not disclosed.
## Tools & Infrastructure
* **Malware Families:**
* **FDMTP Backdoor:** An updated, modular .NET-based Remote Access Trojan (RAT).
* **Plugins:** Specialized modules for process manipulation and file retrieval.
* **Communication Protocols:** DMTP (Differentiated Mail Transfer Protocol) and TCP.
* **Infrastructure:**
* C2 endpoints disguised as CDNs (impersonating Yahoo and Apple).
* Specific endpoint observed: `/GetCluster` with parameter `protocol=Dotnet-Tcpdmtp`.
* *Note: Specific defanged IPs/URLs were not provided in the source text; only the impersonation behavior was noted.*
## Implications
The campaign demonstrates a high level of operational maturity, focusing on "behavioral consistency" rather than reliance on easily identifiable malware markers. By rotating infrastructure and using legitimate Windows tools, the actor significantly lowers the probability of detection by traditional signature-based security solutions. The strategic aim appears to be long-term espionage and persistence within the Asia-Pacific region.
## Mitigations
* **Behavioral Monitoring:** Monitor for the specific sequence of downloading a legitimate binary followed immediately by a `.config` and DLL file.
* **Process Auditing:** Closely monitor trusted Windows processes (like ClickOnce or Visual Studio) for unusual child processes or network connections.
* **Endpoint Detection (EDR):** Implement rules to detect DLL sideloading and search-order hijacking by monitoring file integrity and unexpected DLL loads in common system directories.
* **Network Filtering:** Inspect outbound traffic for non-standard protocols residing on HTTP/HTTPS ports (e.g., DMTP traffic).