# APT41/Silver Dragon Expanding Enterprise Attack Surface — Google Drive C2, AppDomain Hijacking, Cloud/Supply Chain Targeting

> China-linked APT41 and its Silver Dragon subgroup are actively targeting government entities in Europe and Southeast Asia using novel tooling including GearDoor (Google Drive C2), BamboLoader, MonikerLoader, and SilverScreen. The group exploits public-facing applications including Ivanti EPMM (CVE-2025-4427/CVE-2025-4428), conducts spear-phishing with weaponized LNK files, hijacks Windows services for persistence, and leverages AppDomain hijacking and DLL side-loading for defense evasion.

- **Published:** 2026-03-27T12:00:00Z
- **Last reviewed:** 2026-03-27T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0292
- **ID:** TL-2026-0292
- **Severity:** HIGH (CVSS 8.5)
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** APT41 (China)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-4427, CVE-2025-4428, CVE-2021-44228, CVE-2021-26855, CVE-2019-19781, CVE-2020-10189

## Description

APT41 (also tracked as Brass Typhoon, Wicked Panda, and BARIUM) is a prolific China-linked threat actor conducting both state-sponsored espionage and financially motivated operations. In March 2026, Check Point Research disclosed the activities of Silver Dragon, a previously unreported APT41 subgroup actively targeting government entities in Europe and Southeast Asia since mid-2024.

Silver Dragon employs three distinct delivery chains to deploy payloads. The first uses AppDomain hijacking: a RAR archive containing a batch script that executes MonikerLoader, a heavily obfuscated .NET-based loader that decrypts and executes a Cobalt Strike beacon directly in memory. The second chain deploys BamboLoader, a C++ shellcode DLL loader registered as a Windows service, which decrypts and decompresses shellcode staged on disk before injecting it into the legitimate Windows process taskhost.exe. The third chain targets victims via spear-phishing emails with weaponized LNK attachments — primarily targeting Uzbekistan — that trigger PowerShell execution, launching GameHook.exe (a legitimate executable vulnerable to DLL side-loading) which loads graphics-hook-filter64.dll to decrypt and execute the payload stored in simhei.dat.

A key innovation in the Silver Dragon toolset is GearDoor, a .NET backdoor that uses Google Drive as its command-and-control channel. GearDoor authenticates to attacker-controlled Google Drive accounts and uses file extensions as task indicators: PNG files serve as heartbeat beacons with system information, PDF files trigger command execution and directory operations, CAB files enable host enumeration and process listing, RAR files execute payloads (self-updating if named wiatrace.bak), and 7Z files trigger in-memory plugin execution. All communications are encrypted before transmission to the cloud storage C2.

Additional post-exploitation tools include SilverScreen, a .NET screen-monitoring tool that captures periodic screenshots with cursor positioning and compresses them for exfiltration, and SSHcmd, a .NET SSH utility providing remote command execution and file transfer capabilities.

APT41 has a long history of exploiting public-facing applications for initial access. Recent campaigns have exploited Ivanti Endpoint Manager Mobile zero-days (CVE-2025-4427 authentication bypass and CVE-2025-4428 remote code execution), alongside historical exploitation of Log4Shell (CVE-2021-44228), Microsoft Exchange ProxyLogon (CVE-2021-26855), Citrix ADC (CVE-2019-19781), and Zoho ManageEngine (CVE-2020-10189).

The group's expanding attack surface now spans cloud workloads, supply chains, remote devices, and operational technology environments. Cobalt Strike beacons deployed by Silver Dragon are configured for multiple C2 channels including DNS tunneling, HTTP via Cloudflare CDN, and SMB communication for intra-network lateral movement. Analysis of recovered artifacts indicates the use of an automated payload generation framework, as all files within initial archives share identical creation timestamps. A recovered log file documented per-attack configuration parameters including file paths, service names, encryption keys, and target processes.

Attribution to APT41 is established through post-exploitation script overlap with known APT41 activity and through BamboLoader decryption mechanisms that match previously documented China-nexus APT shellcode loaders. The group has deployed over 30 malware families across campaigns, including KEYPLUG, DUSTPAN, DUSTTRAP, ShadowPad, PlugX, Winnti, and TOUGHPROGRESS.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1569 System Services
- T1047 Windows Management Instrumentation
- T1574 Hijack Execution Flow
- T1543 Create or Modify System Process
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1505 Server Software Component
- T1134 Access Token Manipulation
- T1055 Process Injection
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1014 Rootkit
- T1070 Indicator Removal
- T1553 Subvert Trust Controls
- T1003 OS Credential Dumping
- T1110 Brute Force
- T1082 System Information Discovery
- T1087 Account Discovery
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1550 Use Alternate Authentication Material
- T1113 Screen Capture
- T1056 Input Capture
- T1560 Archive Collected Data
- T1102 Web Service
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1048 Exfiltration Over Alternative Protocol
- T1486 Data Encrypted for Impact

## Sources

- [Cyble: APT41 Enterprise Attack Surface and Cyber Risk Analysis](https://cyble.com/blog/apt41-enterprise-attack-surface-cyber-risk/)
- [The Hacker News: APT41-Linked Silver Dragon Targets Government Entities](https://thehackernews.com/2026/03/apt41-linked-silver-dragon-targets.html)
- [Security Affairs: From Phishing to Google Drive C2 — Silver Dragon Expands APT41 Playbook](https://securityaffairs.com/188895/apt/from-phishing-to-google-drive-c2-silver-dragon-expands-apt41-playbook.html)
- [MITRE ATT&CK: APT41 Group Profile (G0096)](https://attack.mitre.org/groups/G0096/)
- [Google Cloud Threat Intelligence: APT41 Innovative Tactics (TOUGHPROGRESS / Google Calendar C2)](https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics)
- [Darktrace: AI Caught APT41 Exploiting Zero-Day Vulnerability (CVE-2020-10189)](https://www.darktrace.com/blog/catching-apt41-exploiting-a-zero-day-vulnerability)
- [Check Point Research: Silver Dragon — New APT41 Subgroup Targeting Governments](https://research.checkpoint.com/2026/silver-dragon-apt41-subgroup/)
- [NVD: CVE-2025-4427 — Ivanti EPMM Authentication Bypass](https://nvd.nist.gov/vuln/detail/CVE-2025-4427)
- [NVD: CVE-2025-4428 — Ivanti EPMM Remote Code Execution](https://nvd.nist.gov/vuln/detail/CVE-2025-4428)
- [CISA: Known Exploited Vulnerabilities Catalog — CVE-2025-4427/4428](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0292