Loading threat actor…
Silver Dragon is a China-linked cyberespionage threat cluster assessed with high confidence to operate within, or closely alongside, the APT41 ecosystem. Active since at least mid-2024, it has targeted government ministries, government entities, and other high-profile public sector organizations across Southeast Asia and Europe. Reported targeting has included government organizations in Uzbekistan, and the group is characterized as Chinese-aligned based on tradecraft overlap with APT41, UTC+8-aligned compilation patterns, and operational similarities in loader installation and post-exploitation workflows. Silver Dragon gains initial access through exploitation of public-facing servers and phishing emails carrying malicious attachments, including weaponized LNK files. Observed intrusion chains include AppDomain hijacking, malicious service DLL deployment, and phishing-based loader delivery. Across these chains, the actor commonly deploys Cobalt Strike for early foothold and control, and has used DNS tunneling, HTTP-based communications, SMB within victim networks, and a custom Google Drive-based backdoor for command and control. A defining feature of Silver Dragon is its abuse of legitimate Windows components and services for stealth and persistence. The group has hijacked Windows service infrastructure, including Windows Update-related, .NET-related, Bluetooth-related, and other legitimate service contexts, to blend malicious execution into normal system activity. It has also used DLL side-loading and in-memory loader chains to decrypt, decompress, and inject payloads into legitimate processes, reflecting a mature defense-evasion and persistence tradecraft. Custom tooling attributed to Silver Dragon includes GearDoor, SilverScreen, and SSHcmd, alongside loaders such as MonikerLoader and BamboLoader. GearDoor is a .NET backdoor that uses Google Drive as a file-based command-and-control channel, enabling encrypted tasking, payload delivery, self-update, and in-memory plugin execution while blending into trusted cloud traffic. SilverScreen is used for periodic screenshot capture and surveillance of victim activity. SSHcmd is a .NET SSH utility used for remote command execution, file transfer, and post-compromise operations. The actor has also used Cobalt Strike beacons configured for multiple communication methods. Silver Dragon’s observed behavior supports a cyberespionage mission focused on long-term access to government and public sector networks. Its capabilities include initial access, persistence, defense evasion, reconnaissance, credential theft, lateral movement, post-exploitation, and exfiltration-related collection activity. Known aliases are limited; Silver Dragon is primarily referenced as a distinct APT41-linked or APT41-spinoff cluster rather than under a broad alternate naming set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
42 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
1 indicator attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-nexus espionage group conducting sustained intrusions against government ministries in Southeast Asia and Europe, using server exploitation, phishing, service hijacking, and cloud-masked command and control.
Chinese-aligned group linked to APT41 targeting government and enterprise networks in Southeast Asia and Europe; uses GearDoor backdoor with SSHcmd and SilverScreen for remote access, covert screen capture, and stealthy control following phishing and server exploitation.
APT41-linked spinoff activity cluster reported by Check Point as conducting a lengthy campaign targeting Asia; specific tooling and TTPs not described in this content.
Activity cluster reported targeting organizations in Southeast Asia and Europe.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.