From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools
Summary: A China-linked threat actor accessed a U.S. non-profit's network for several weeks in April 2025, with Symantec and Carbon Black reporting that initial scanning on April 5 using exploits such as CVE-2021-44228 (Log4j) and CVE-2022-26134 (Atlassian) showed no sign of success, and that access was suspected to come from brute-force or credential stuffing. On April 16 the attackers ran curl and netstat, set up a scheduled task running msbuild.exe and a second task every 60 minutes as SYSTEM that injected code into csc.exe to reach a command-and-control server at 38.180.83[.]166, and also side-loaded a DLL via the legitimate Vipre component vetysafe.exe.
What you should know: Symantec and Carbon Black said the attackers were interested in domain controllers, which could let them spread to many machines on the network, and the same malicious DLL has appeared in activity attributed to Salt Typhoon and APT41's Earth Longzhi - tool sharing that makes attribution difficult.