Story perspectives

APT24's Stealthy Cyber Espionage Targets Global Supply Chains

11/22/2025

Summary

Story summary

Google's Threat Intelligence Group (GTIG) reports a three-year cyber espionage campaign by APT24, a Chinese threat actor, using BADAUDIO to achieve stealth and persistent access.
The campaign shifted to targeted supply chain attacks, compromising a digital marketing firm in Taiwan and affecting over 1,000 domains.
The BADAUDIO malware uses control flow flattening and DLL hijacking.
APT24 conducts targeted phishing campaigns delivering malware via cloud services, signaling rising sophistication.

1 of 1

Story summary

Google's Threat Intelligence Group (GTIG) reports a three-year cyber espionage campaign by APT24, a Chinese threat actor, using BADAUDIO to achieve stealth and persistent access.
The campaign shifted to targeted supply chain attacks, compromising a digital marketing firm in Taiwan and affecting over 1,000 domains.
The BADAUDIO malware uses control flow flattening and DLL hijacking.
APT24 conducts targeted phishing campaigns delivering malware via cloud services, signaling rising sophistication.