Prevent Brand Abuse with Darktrace | Protect Your Brand
Prevent brand abuse with Darktrace's AI-powered solution. Detect and stop impersonation attacks before they harm your reputation. Read to learn more here.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
Written by
Elliot Stocker
Product SME
Share
13
Nov 2022
Brand abuse refers to the unauthorized imitation of an organization's brand. Its discovery is often a reminder to organizations that they need to protect more than just their data and IP – their reputation is at stake. But brand impersonation can also be used to launch a direct attack against the organization – and those around it.
During a first demonstration meeting recently, Darktrace PREVENT discovered a website deploying a classic trick: the letters ‘rn’ were used in sequence in an attempt to imitate the letter ‘m’ in the company’s name (e.g. “exarnple-brand.com”). Whilst obvious when you’re looking out for it, for an unsuspecting employee this goes easily unnoticed.
This website was set up by an attacker two weeks before the PREVENT demo. The website was taken down immediately, and the company was also advised to launch an internal investigation to find out if somebody had received an email from this address. The company also launched an information campaign informing their supply chain of this attack, and this last activity resulted in the discovery that one of their suppliers had been scammed through the same email domain and had transferred a large sum of money towards a shell company that was not related to the main brand. By alerting that supplier, additional money transfers were prevented.
This example is part of a broader trend being seen across the industry. ZDNET’s Fraud Trends Report found that roughly 250,000 attacks in Q2 of 2021 involved some form of brand abuse. These attacks harm companies by inflicting reputational damage, incurring financial losses from fraudulent competition, or serving as steppingstones for larger threats like supply chain attacks.
Organizations work hard to cultivate brand identities that differentiate themselves from competitors and build relationships with consumers. Yet, the stronger and more recognizable a brand is, the more often it is targeted for abuse as malicious actors take advantage of their success to reach more victims. Companies with greater online presences or international operations across multiple channels are also at higher risk.
Brand abuse takes many forms. It can be a website designed to look like it belongs to the brand to collect personal information such as email addresses and passwords. It can be an invoice sent by a vendor with a slight typo in its name. It can be an unauthorized branded webshop that never ships products to buyers. It can be a fake social media account directing customers to malicious websites that distribute malware or spreading fake news. It can be as simple as copyright or trademark infringement.
Figure 1: The general pattern malicious actors use for brand abuse.
Responding to Brand Abuse
Reconquering brand reputation after a brand abuse incident can prove to be much more difficult and costly than investing beforehand to help secure the brand. Risk detection and monitoring require a holistic approach to cover the diverse forms of brand abuse, and requires patrolling the internet for copycats, typo squatters, and other malicious appropriations.
Figure 2: Mapping to the stages of brand abusein Figure 1, the security team has a set of signals to look for and actions totake to stop brand abuse before it is too late.
Protecting the brand identity and external attack surface can seem like a daunting task for security teams, especially in an age where monitoring internal systems proves enough of a challenge itself. Moreover, how often should the team perform this brand abuse monitoring? Companies can try to search every six months, every quarter, even every month, however there would still be gaps between when a threat actor launches an attack and when the security team discovers it. This is when AI becomes a tremendous ally, as it works at a speed and scale that human teams cannot.
The Power of PREVENT
PREVENT/Attack Surface ManagementTM works autonomously and continuously to uncover instances of brand abuse, and proactively hardens defenses against any attack that might be launched as a result.
It uses AI to distinguish a company’s external assets from the rest of the global internet. Its processing features learn brand-related assets such as logos and domain names. It also leverages natural language processing and image classification algorithms to tackle even the most ambiguous and error-prone assets encountered to identify and stop copycats and typosquatters.
PREVENT/ASM carries out this comprehensive level of monitoring continuously, closing the gap between when an attacker spins up malicious infrastructure and when the security team identifies it. With PREVENT, should an attacker create a malicious website tomorrow morning, the security team will be alerted tomorrow morning.
In addition to identifying brand abuse, PREVENT/ASM helps the team to collect all the relevant data needed to support a Notice and Takedown procedure. It also integrates with the rest of Darktrace’s security ecosystem to ensure that cyber defense is hardened ahead of time, should malicious assets discovered by PREVENT/ASM be used to launch an attack.
For example, identifying a webpage impersonating a brand is useful data for email security. PREVENT forewarns Darktrace/Email of malicious domains, which in turn heightens its sensitivity against emails sent from this site. The same is true with regards to network traffic as well as endpoint security: an endpoint device visiting this host will have Darktrace DETECTTM + Darktrace RESPONDTM on higher alert – ready to immediately neutralize threatening activity when it occurs.
This is the power of the Cyber AI Loop, a virtuous feedback cycle in which AI engines continuously feed into and strengthen one another.
And PREVENT not only identifies instances of brand abuse (along with Shadow IT, misconfigurations, supply chain risk, and other vulnerabilities), but it also prioritizes these risks according to exposure and potential damage and impact. With PREVENT/End-to-EndTM using Darktrace’s understanding of every device and connection inside an organization – every user and their interactions, every possible attack path – insights from the internal and external attack surface combine to give security teams a fully informed understanding of how they can spend their time most effectively to reduce cyber risk.
In these ways, PREVENT not only monitors for brand abuse at a scope and scale far beyond the capabilities of human security teams, but it also integrates with DETECT + RESPOND to harden a company’s cyber security.
Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.
AI-powered security for a rapidly growing grocery enterprise
By combining AI-driven detection and autonomous response, this leading grocery holding group has built a security model that delivers continuous protection, accelerates growth, and empowers a small, highly efficient team to safeguard a complex retail ecosystem.
How a Leading Bank is Prioritizing Risk Management to Power a Resilient Future
This influential southern European bank has strengthened its cyber resilience with Darktrace, unifying its risk landscape, reducing manual effort, and empowering teams to proactively prioritize and mitigate exposures with confidence.
Patch Smarter, Not Harder: Now Empowering Security Teams with Business-Aligned Threat Context Agents
This blog introduces new innovations in Darktrace / Proactive Exposure Management that bring precision and clarity to vulnerability prioritization. Learn how No-Telemetry Endpoints provide real device context without network data and how new Cost-Benefit Analysis capabilities quantify patching ROI—helping teams cut noise, act faster, and strengthen proactive risk management.
AI Insider Threats: How Generative AI is Changing Insider Risk
How generative AI changes insider behavior
AI systems, especially generative platforms such as chatbots, are designed for engagement with humans. They are equipped with extraordinary human-like responses that can both confirm, and inflate, human ideas and ideology; offering an appealing cognitive partnership between machine and human. When considering this against the threat posed by insiders, the type of diverse engagement offered by AI can greatly increase the speed of an insider event, and can facilitate new attack platforms to carry out insider acts.
This article offers analysis on how to consider this new paradigm of insider risk, and outlines key governance principles for CISOs, CSOs and SOC managers to manage the threats inherent with AI-powered insider risk.
What is an insider threat?
There are many industry or government definitions of what constitutes insider threat. At its heart, it relates to the harm created when trusted access to sensitive information, assets or personnel is abused bywith malicious intent, or through negligent activities.
Traditional methodologies to manage insider threat have relied on two main concepts: assurance of individuals with access to sensitive assets, and a layered defense system to monitor for any breach of vulnerability. This is often done both before, and after access has been granted. In the pre-access state, assurance is gained through security or recruitment checks. Once access is granted, controls such as privileged access, and zero-trust architecture offer defensive layers.
How does AI change the insider threat paradigm?
While these two concepts remain central to the management of insider threats, the introduction of AI offers three key new aspects that will re-shape the paradigm:.
AI can act as a cognitive amplifier, influencing and affecting the motivations that can lead to insider-related activity. This is especially relevant for the deliberate insider - someone who is considering an act of insider harm. These individuals can now turn to AI systems to validate their thinking, provide unique insights, and, crucially, offer encouragement to act. With generative systems hard-wired to engage and agree with users, this can turn a helpful AI system into a dangerous AI hype machine for those with harmful insider intent.
AI can act as an operational enabler. AI can now develop and increase the range of tools needed to carry out insider acts. New social engineering platforms such as vishing and deepfakes give adversaries a new edge to create insider harm. AI can generate solutions and operational platforms at increasing speeds; often without the need for human subject matter expertise to execute the activities. As one bar for advanced AI capabilities continues to be raised, the bar needed to make use of those platforms has become significantly lower.
AI can act as a semi-autonomous insider, particularly when agentic AI systems or non-human identities are provided broad levels of autonomy; creating a vector of insider acts with little-to-no human oversight or control. As AI agents assume many of the orchestration layers once reserved for humans, they do so without some of the restricted permissions that generally bind service accounts. With broad levels of accessibility and authority, these non-human identities (NHIs) can themselves become targets of insider intent. Commonly, this refers to the increasing risks of prompt injection, poisoning, or other types of embedded bias. In many ways, this mirrors the risks of social engineering traditionally faced by humans. Even without deliberate or malicious efforts to corrupt them, AI systems and AI agents can carry out unintended actions; creating vulnerabilities and opportunities for insider harm.
How to defend against AI-powered insider threats
The increasing attack surfaces created or facilitated by AI is a growing concern. In Darktrace’s own AI cybersecurity research, the risks introduced, and acknowledged, through the proliferation of AI tools and systems continues to outstrip traditional policies and governance guardrails. 22% of respondents in the survey cited ‘insider misuse aided by generative AI’ as a major threat concern. And yet, in the same survey, only 37% of all respondents have formal policies in place to manage the safe and responsible use of AI. This draws a significant and worrying delta between the known risks and threat concerns, and the ability (and resources) to mitigate them.
What can CISOs and SOC leaders do to protect their organization from AI insider threats?
Given the rapid adaptation, adoption, and scale of AI systems, implementing the right levels of AI governance is non-negotiable. Getting the correct balance between AI-driven productivity gains and careful compliance will lead to long-term benefits. Adapting traditional insider threat structures to account for newer risks posed through the use of AI will be crucial. And understanding the value of AI systems that add to your cybersecurity resilience rather than imperil it will be essential.
For those responsible for the security and protection of their business assets and data holdings, the way AI has changed the paradigm of insider threats can seem daunting. Adopting strong, and suitable AI governance can become difficult to introduce due to the volume and complexity of systems needed to be monitored. As well as traditional insider threat mitigations such as user monitoring, access controls and active management, the speed and autonomy of some AI systems need different, as well as additional layers of control.
How Darktrace helps protect against AI-powered insider threats
Darktrace has demonstrated that, through platforms such as our proprietary Cyber AI Analyst, and our latest product Darktrace / SECURE AI, there are ways AI systems can be self-learning, self-critical and resilient to unpredictable AI behavior whilst still offering impressive returns; complementing traditional SOC and CISO strategies to combat insider threat.
With / SECURE AI, some of the ephemeral risks drawn through AI use can be more easily governed. Specifically, the ability to monitor conversational prompts (which can both affect AI outputs as well as highlight potential attempts at manipulation of AI; raising early flags of insider intent); the real-time observation of AI usage and development (highlighting potential blind-spots between AI development and deployment); shadow AI detection (surfacing unapproved tools and agents across your IT stack) and; the ability to know which identities (human or non-human) have permission access. All these features build on the existing foundations of strong insider threat management structures.
How to take a defense-in-depth approach to AI-powered insider threats
Even without these tools, there are four key areas where robust, more effective controls can mitigate AI-powered insider threat. Each of the below offers a defencce-in-depth approach: layering acknowledgement and understanding of an insider vector with controls that can bolster your defenses.
Identity and access controls
Having a clear understanding of the entities that can access your sensitive information, assets and personnel is the first step in understanding the landscape in which insider harm can occur. AI has shown that it is not just flesh and bone operators who can administer insider threats; Non-Human Identities (such as agentic AI systems) can operate with autonomy and freedom if they have the right credentials. By treating NHIs in the same way as human operators (rather than helpful machine-based tools), and adding similar mitigation and management controls, you can protect both your business, and your business-based identities from insider-related attention.
Visibility and shadow AI detection
Configuring AI systems carefully, as well as maintaining internal monitoring, can help identify ‘shadow AI’ usage; defined as the use of unsanctioned AI tools within the workplace1 (this topic was researched in Darktrace’s own paper on "How to secure AI in the enterprise". The adoption of shadow AI could be the result of deliberate preference, or ‘shortcutting’; where individuals use systems and models they are familiar with, even if unsanctioned. As well as some performance risks inherent with the use of shadow AI (such as data leakage and unwanted actions), it could also be a dangerous precursor for insider-related harm (either through deliberate attempts to subvert regular monitoring, or by opening vulnerabilities through unpatched or unaccredited tooling).
Prompt and Output Guardrails
The ability to introduce guardrails for AI systems offers something of a traditional “perimeter protection” layer in AI defense architecture; checking prompts and outputs against known threat vectors, or insider threat methodologies. Alone, such traditional guardrails offer limited assurance. But, if tied with behavior-centric threat detection, and an enforcement system that deters both malicious and accidental insider activities, this would offer considerable defense- in- depth containment.
Forensic logging and incident readiness response
The need for detection, data capture, forensics, and investigation are inherent elements of any good insider threat strategy. To fully understand the extent or scope of any suspected insider activity (such as understanding if it was deliberate, targeted, or likely to occur again), this rich vein of analysis could prove invaluable. As the nature of business increasingly turns ephemeral; with assets secured in remote containers, information parsed through temporary or cloud-based architecture, and access nodes distributed beyond the immediate visibility of internal security teams, the development of AI governance through containment, detection, and enforcement will grow ever more important.
Enabling these controls can offer visibility and supervision over some of the often-expressed risks about AI management. With the right kind of data analytics, and with appropriate human oversight for high-risk actions, it can illuminate the core concerns expressed through a new paradigm of AI-powered insider threats by:
Ensuring deliberately mis-configured AI systems are exposed through regular monitoring.
Highlighting changes in systems-based activity that might indicate harmful insider actions; whether malicious or accidental.
Promoting a secure-by-design process that discourages and deters insider-related ambitions.
Ensuring the control plane for identity-based access spans humans, NHIs and AI models, and:
Offering positive containment strategies that will help curate the extent of AI control, and minimize unwanted activities.
Why insider threat remains a human challenge
At its root, and however it has been configured, AI is still an algorithmic tool; something designed to automate, process and manage computational functions at machine speed, and boost productivity. Even with the best cybersecurity defenses in place, the success of an insider threat management program will still depend on the ability of human operators to identify, triage, and manage the insider threat attack surface.
AI governance policies, human-in-the-loop break points, and automated monitoring functions will not guard against acts of insider harm unless there is intention to manage this proactively, and through a strong culture of how to guard against abuses of trust and responsibility.
Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor
Darktrace have identified activity consistent with Chinese-nexus operations, a Twill Typhoon-linked campaign targeting customer environments, primarily within the Asia-Pacific & Japan (APJ) region
Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.
The activity aligns with patterns described in Darktrace’s previous Chinese-nexus operations report, Crimson Echo. In this case, observed modular intrusion chains built on legitimate software, and staged payload delivery. Threat actors retrieve legitimate binaries alongside configuration files and malicious DLLs to enable sideloading of a .NET-based RAT.
Observed Campaign
Across cases, the same ordered sequence appears: retrieval of a legitimate executable, (2) retrieval of a matching .config file, (3) retrieval of the malicious
DLL, (4) repeated DLL downloads over time, and (5) command-and-control (C2) communication. The .config file retrieves a malicious binary, while the legitimate binary provides a legitimate process to run it in.
Darktrace assesses with moderate confidence that this activity aligns with publicly reported Twill Typhoon tradecraft. The observed use of FDMTP, DLL sideloading, and overlapping infrastructure is consistent with previously observed operations, though not unique to a single actor. While initial access was not directly observed, previous Twill Typhoon campaigns have typically involved spear-phishing.
What Darktrace Observed
Since late September 2025, Darktrace has observed multiple customer environments making HTTP GET requests to infrastructure presenting as “CDN” endpoints for well-known platforms (including Yahoo and Apple lookalikes). Across cases, the affected hosts retrieved legitimate executables, then matching .config files (same base filename), then DLLs intended for sideloading. The sequencing of a legitimate binary + configuration + DLL has been previously observed in campaigns linked to China-nexus threat actors.
In several cases, affected hosts also issued outbound requests to a /GetCluster endpoint, including the protocol=Dotnet-Tcpdmtp parameter. This activity was repeatedly followed by retrieval of DLL content that was subsequently used for search-order hijacking within legitimate processes.
In the September–October 2025 cases, Darktrace alerting commonly surfaced early-stage registration and C2 setup behaviors, followed by retrieval of a DLL (e.g., Client.dll) from the same external host, sometimes repeatedly over multiple days, consistent with establishing and maintaining the execution chain.
In April 2026, a finance-sector endpoint initiated a series of GET requests to yahoo-cdn[.]it[.]com, first fetching legitimate binaries (including vshost.exe and dfsvc.exe), then repeatedly retrieving associated configuration and DLL components (including dfsvc.exe.config and dnscfg.dll) over an 11-day window. The use of both Visual Studio hosting and OneClick (dfsvc.exe) paths are used to ensure the malware can run in the targeted environment.
Technical Analysis
Initial staging and execution
While the initial access method is unknown, Darktrace security researchers identified multiple archives containing the malware.
A representative example includes a ZIP archive (“test.zip”) containing:
A legitimate executable: biz_render.exe (Sogou Pinyin IME)
A malicious DLL: browser_host.dll
Contained within the zip archive named “test.zip” is the legitimate binary “biz_render.exe”, a popular Chinese Input Method Editor (IME) Sogou Pinyin.
Alongside the legitimate binary is a malicious DLL named “browser_host.dll”. As the legitimate binary loads a legitimate DLL named “browser_host.dll” via LoadLibraryExW, the malicious DLL has been named the same to sideload the malicious DLL into biz_render.exe. By supplying a malicious DLL with an identical name, the actor hijacks execution flow, enabling the payload to execute within a trusted process.
The legitimate binary invokes the function GetBrowserManagerInstance from the sideloaded “browser_host.dll”, which then performs XOR-based decryption of embedded strings (key 0x90) to resolve and dynamically load mscoree.dll.
The DLL uses the Windows Common Language Runtime (CLR) to execute managed .NET code inside the process rather than relying solely on native binaries. During execution, the loader loads a payload directly into memory as .NET assemblies, enabling an in-memory execution.
C2 Registration
A GET request is made to:
GET /GetCluster?protocol=DotNet-TcpDmtp&tag={0}&uid={1}
with the custom header:
Verify_Token: Dmtp
This returns Base64-encoded and gzip-compressed IP addresses used for subsequent communication.
Figure 2: Decoded IPs.
Staged payload retrieval
Subsequent activity includes retrieval of multiple components from yahoo-cdn.it[.]com. The following GET requests are made:
Dfsvc.exe is the legitimate Windows ClickOnce Engine, part of the .NET framework used for updating ClickOnce Applications. Accompanying dfsvc.exe is a legitimate dfsvc.exe.config file that is used to store configuration data for the application. However, in this instance the malware has replaced the legitimate dfsvc.exe.config with the one retrieved from the server in: C:\Windows\Microsoft.NET\Framework64\v4.0.30319.
Additionally, vhost.exe the legitimate Visual Studio hosting process is retrieved from the server, along with “Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll” and “config.etl”. The DLL is used to decrypt the AES encrypted payload in config.etl and load it. The encrypted payload is dnscfg.dll, which can be loaded into vshost instead of dfsvc, and may be used if the environment does not support .NET.
Figure 3: ClickOnce configuration.
The malicious configuration disables logging, forces the application to load dnscfg.dll from the remote server, and uses a custom AppDomainManager to ensure the DLL is executed during initialization of dfsvc.exe. To ensure persistence, a scheduled task is added for %APPDATA%\Local\Microsoft\WindowsApps\dfsvc.exe.
Core payload
The DLL dnscfg.dll is a .NET binary named Client.TcpDmtp.dll. The payload is a heavily obfuscated backdoor that generates its logic at runtime and communicates with the command and control (C2) over custom TCP, DMTP (Duplex Message Transport Protocol) and appears to be an updated version of FDMTP to version 3.2.5.1
Once connected, the malware enters a persistent loop (LoopMessage), enabling it to receive commands from the remote server.
Figure 5: DMTP Connect function.
Rather than referencing values directly, they are retrieved through containers that are resolved at runtime. String values are stored in an encrypted byte array (_0) and decrypted by a custom XOR-based string decryption routine (dcsoft). The lower 16 bits of the provided key are XORed with 0xA61D (42525) to derive the initial XOR key, while subsequent bits define the string length and offset into the encrypted byte array. Each character is reconstructed from two encrypted bytes and XORed with the incrementing key value, producing the plaintext string used by the payload.
Figure 6: Decrypted strings.
Embedded in the resources section are multiple compressed binaries, the majority of which are library files. The only exceptions are client.core.dll and client.dmtpframe.dll.
Figure 7: Resources.
Modular framework and plugins
The payload embeds multiple compressed libraries, notably:
client.core.dll
client.dmtpframe.dll
Client.core.dll is a core library used for system profiling, C2 communication and plugin execution. The implant has the functionality to retrieve information including antivirus products, domain name, HWID, CLR version, administrator status, hardware details, network details, operating system, and user.
Figure 8: Client.Core.Info functions.
Additionally, the component is responsible for loading plugins, with support for both binary and JSON-based plugin execution. This allows plugins to receive commands and parameters in different formats depending on the task being performed.
The framework handles details such as plugin hashes, method names, task identifiers, caller tracking, and argument processing, allowing plugins to be executed consistently within the environment. In addition to execution management, the library also provides plugins with access to common runtime functionality such as logging, communication, and process handling.
Figure 9: Client.core functions.
client.dmtpframe.dll handles:
DMTP communication
Heartbeats and reconnection
Plugin persistence via registry:
HKCU\Software\Microsoft\IME\{id}
Client.dmtpframe.dll is built on the TouchSocket DMTP networking library and continues to manage the remote plugins. The DLL implements remote communication features including heartbeat maintenance, reconnection handling, RPC-style messaging, SSL support, and token-based verification. The DLL also has the ability to add plugins to the registry under HKCU/Software/Microsoft/IME/{id} for persistence.
Plugins observed
While the full set of plugins remains unknown, researchers were able to identify four plugins, including:
Persist.WpTask.dll - used to create, remove and trigger scheduled Windows tasks remotely.
Persist.registry.dll - used to manage registry persistence with the ability to create, and delete registry values, along with hidden persistence keys.
Persist.extra.dll - used to load and persist the main framework.
Assist.dll - used to remotely retrieve files or commands, as well as manipulate system processes.
Figure 10: Plugins stored in IME registry.
Figure 11: Obfuscated script in plugin resources.
Persist.extra.dll is a module that is used to load a script “setup.log” to load and persist the main framework. Stored within the resources section of the binary is an obfuscated script that creates a .NET COM object that is added to the registry key HKCU\Software\Classes\TypeLib\ {9E175B61-F52A-11D8-B9A5-505054503030} \1.0\1\Win64 for persistence. After deobfuscating this script, another DLL is revealed named “WindowsBase.dll”.
Figure 12: Registry entry for script.
The binary checks in with icloud-cdn[.]net every five minutes, retrieves a version string, downloads an encrypted payload named checksum.bin, saves it locally as C:\ProgramData\USOShared\Logs\checksum.etl, decrypts it with AES using the hardcoded key POt_L[Bsh0=+@0a., and loads the decrypted assembly directly from memory via Assembly.Load(byte[]). The version.txt file acts as an update marker so it only re-downloads when the remote version changes, while the mutex prevents duplicate instances.
Figure 13: USOShared/Logs.
Checksum.etl is decrypted with AES and loaded into memory, loading another .NET DLL named “Client.dll”. This binary is the same as “dnscfg.dll” mentioned at the start and allows the threat actors to update the main framework based on the version.
Conclusion
Across cases, Darktrace consistently observed the following sequence:
Retrieval of legitimate executables
Retrieval of DLLs for sideloading
C2 registration via /GetCluster
This approach is consistent with broader China-nexus tradecraft. As outlined in Darktrace’s Crimson Echo report, the stable feature of this activity is behavioral. Infrastructure rotates and payloads can change, but the execution model persists. For defenders, the implication is straightforward: detection anchored to individual indicators will degrade quickly. Detection anchored to a behavioral sequence offer a far more durable approach.
Credit to Tara Gould (Malware Research Lead), Adam Potter (Senior Cyber Analyst), Emma Foulger (Global Threat Research Operations Lead), Nathaniel Jones (VP, Security & AI Strategy)
Edited by Ryan Traill (Content Manager)
Appendices
A detailed list of detection models and triggered indicators is provided alongside IoCs.
.avif)
.avif)
