APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains
Summary: Google Threat Intelligence Group reports that APT24, a suspected China-nexus group also called Pitty Tiger, has used a previously undocumented C++ malware named BADAUDIO since November 2022 to maintain persistent remote access, pivoting from broad strategic web compromises to supply chain attacks and targeted phishing against organizations in Taiwan. From July 2024 the group breached a regional Taiwanese digital marketing firm and injected malicious JavaScript into a widely used library it distributed, and for a ten-day period in August lifted targeting conditions so that all 1,000 domains using the scripts were compromised.
Why it matters: A single compromised marketing vendor gave APT24 a foothold across more than 1,000 domains, and the group's watering holes deliberately excluded macOS, iOS, and Android visitors while fingerprinting the rest before serving a fake Chrome update. The ten-day window when targeting restrictions were lifted shows how quickly a narrowly scoped supply chain intrusion can widen to every site running the same third-party script.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2012-0158CVE-2014-1761
- Related
- CVE-2014-1761, Oh did you mean CVE-2012-2539? Cyber Risks ·Digital Quartermaster Scenario Demonstrated in Attacks Against the Mongolian Government Cyber Risks ·When combining exploits for added effect goes wrong Cyber Risks ·