{
  "name": "Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor",
  "slug": "chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor",
  "description": "Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.",
  "published": "2026-05-18T19:29:26.882000+00:00",
  "created_at": "2026-05-18T19:56:26.161000+00:00",
  "modified_at": "2026-05-18T17:56:26+00:00",
  "created_at_opencti": "2026-05-18T19:56:26.161000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "anomalous file",
    "apt",
    "chinese",
    "rat",
    "remote access",
    "twill typhoon",
    "visual studio"
  ],
  "tags": [
    "2026-05-18",
    "anomalous file",
    "apt",
    "chinese",
    "rat",
    "remote access",
    "twill typhoon",
    "visual studio"
  ],
  "related_entities": {
    "indicators": [
      {
        "id": "3644aeb9-0075-461d-8f7f-57fb84fea67e",
        "name": "47911cb0428f042c2da010ad833cf3830594ecb70cf5d1068ec969751d87647d"
      },
      {
        "id": "5de22eae-a186-4d08-b457-a631806e2a94",
        "name": "0bb1e7190c781ce5dd02304511604c225f0b1b5efe9c62583971266ef0b4ff3a"
      },
      {
        "id": "9bd12446-5234-4036-b848-96ecafd5f758",
        "name": "www.icloud-cdn.net"
      }
    ],
    "intrusion_sets": [
      {
        "id": "d84a7548-8d06-45c7-80bf-46911d6e40c0",
        "name": "MUSTANG PANDA",
        "slug": "mustang-panda"
      }
    ],
    "attack_patterns": [
      {
        "id": "2f07e892-0128-454b-9413-803505e67b48",
        "name": "T1030"
      },
      {
        "id": "926a888c-190c-4efb-ab6b-f9d7e6a0fc54",
        "name": "T1547"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "f48eade0-2f45-4ff7-aa61-8ba887887f81",
        "name": "T1123"
      },
      {
        "id": "ecaaa4cc-d487-4002-bcb2-f769acfcc38f",
        "name": "T1490"
      },
      {
        "id": "fcd96dc0-500e-4354-bd97-5c65718a9004",
        "name": "T1562"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "6e4e21cc-92cf-4564-920e-d509bd22fd40",
        "name": "T1574"
      },
      {
        "id": "88fa397b-4cc9-42c0-b52d-4108f9630529",
        "name": "T1095"
      },
      {
        "id": "14da8ebf-e0b0-4d4e-9c83-56277980f266",
        "name": "T1134"
      },
      {
        "id": "3be1a227-bbd0-4e76-9422-40e4078224f9",
        "name": "T1007"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      },
      {
        "id": "306ee8dc-1d64-4916-96be-18060d690ad7",
        "name": "T1499"
      },
      {
        "id": "358e04b8-6f65-48b2-a24b-f101bfc6671a",
        "name": "T1195"
      },
      {
        "id": "7d03ac30-b4e0-4ef9-bb23-80667e2c8123",
        "name": "T1127"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "observables": [
      {
        "id": "d490f421-6390-40ce-bc25-e54017f026d8",
        "name": "www.icloud-cdn.net"
      },
      {
        "id": "",
        "name": "47911cb0428f042c2da010ad833cf3830594ecb70cf5d1068ec969751d87647d"
      },
      {
        "id": "",
        "name": "0bb1e7190c781ce5dd02304511604c225f0b1b5efe9c62583971266ef0b4ff3a"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Universities"
      },
      {
        "id": "",
        "name": "Investments"
      }
    ]
  },
  "external_refs": [
    {
      "id": "6299782d-16ff-4efb-9138-5a7be7ea63a9",
      "standard_id": "external-reference--1e1d259a-31c5-5d16-aca6-d9772abb5a82",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.darktrace.com/blog/chinese-apt-campaign-targets-entities-with-updated-fdmtp-backdoor",
      "hash": null,
      "external_id": null,
      "created": "2026-05-18T19:56:18.502Z",
      "modified": "2026-05-18T19:56:18.502Z",
      "createdById": null
    },
    {
      "id": "15184572-ca17-49bb-a832-6792d568d7a5",
      "standard_id": "external-reference--6495f7c6-cf2c-5855-9eea-7ad8ae06399b",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a0b6898afd39bdd2dd6f142",
      "hash": null,
      "external_id": "6a0b6898afd39bdd2dd6f142",
      "created": "2026-05-18T19:56:18.471Z",
      "modified": "2026-05-18T19:56:18.471Z",
      "createdById": null
    }
  ]
}