Silver Dragon
Silver Dragon is a China-linked, Chinese-aligned cyberespionage threat group assessed by Check Point Research with high confidence to be linked to the APT41 ecosystem and likely operating under the APT41 umbrella. It has targeted organizations across Southeast Asia and Europe since at least mid-2024, with a particular focus on government entities, government ministries, and other public sector or high-profile organizations. Reported targeting includes government entities in Uzbekistan. Observed initial access methods include exploitation of public-facing internet servers and phishing emails with malicious attachments, including weaponized LNK files. Check Point described three infection chains used by the group: AppDomain hijacking, service DLL hijacking/deployment, and phishing with malicious LNK attachments. In these campaigns, Silver Dragon deployed Cobalt Strike beacons after compromise and also used DNS tunneling, HTTP communications in some cases, and SMB for communications within victim networks. For persistence and stealth, Silver Dragon hijacks legitimate Windows services and components, including Windows Update, .NET utilities, Bluetooth-related components, and services such as wuausrv, bthsrv, DfSvc, tzsync, and COMSysAppSrv. Reported loaders and malware used by the group include MonikerLoader, BamboLoader, and GearDoor. GearDoor is a .NET backdoor that uses Google Drive as a file-based command-and-control channel, exchanging encrypted tasking and results through files and per-victim folders. Additional custom tooling includes SilverScreen, used for screenshot capture, and SSHcmd, a .NET SSH utility used for remote command execution, file transfer, and remote access/lateral movement. Check Point also reported tradecraft overlap with APT41, including similarities to installation scripts previously documented by Mandiant, use of BamboLoader-related mechanisms, and operational correlation with campaigns previously associated with APT41. The content describes Silver Dragon as a spinoff of APT41 and a China-nexus group tied to that ecosystem. Known alias in the provided content: silver_dragon.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
Recent activity
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-nexus espionage group conducting sustained intrusions against government ministries in Southeast Asia and Europe, using server exploitation, phishing, service hijacking, and cloud-masked command and control.
Chinese-aligned group linked to APT41 targeting government and enterprise networks in Southeast Asia and Europe; uses GearDoor backdoor with SSHcmd and SilverScreen for remote access, covert screen capture, and stealthy control following phishing and server exploitation.
APT41-linked spinoff activity cluster reported by Check Point as conducting a lengthy campaign targeting Asia; specific tooling and TTPs not described in this content.
Activity cluster reported targeting organizations in Southeast Asia and Europe.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.