GearDoor
GearDoor is a .NET backdoor used in the China-linked Silver Dragon intrusion cluster, which multiple reports assess as operating within or overlapping the APT41 ecosystem. It has been used in cyberespionage campaigns targeting government and other high-profile organizations in Southeast Asia and Europe since at least mid-2024. Silver Dragon has delivered GearDoor after initial access obtained through exploitation of public-facing servers and phishing emails with malicious attachments, alongside other tooling such as Cobalt Strike, SSHcmd for remote command execution and file transfer, and SilverScreen for screenshot capture.
A defining characteristic of GearDoor is its use of Google Drive as a file-based command-and-control channel, including use of a dedicated Google Drive account, allowing malicious traffic to blend with trusted cloud-service usage. Reports describe GearDoor creating a unique Google Drive folder per infected machine using a SHA-256 hash of the hostname. It exchanges tasking and results through specially crafted file extensions: .cab for commands to execute, .pdf for directory tasks, .rar for payload delivery or self-update, and .7z for in-memory .NET plugin execution. After completing tasks, it deletes input files and uploads a .bak result file; it also uploads a heartbeat file with a .png extension containing host information such as hostname, username, IP address, and OS version.
Communications are described as encrypted; one report specifies DES encryption with the key derived from the first 8 characters of an MD5 hash of a hardcoded string. Reporting also notes similarities between GearDoor and MonikerLoader, and that changes in GearDoor command sets across versions suggest ongoing testing and development by the operators. High-confidence behavioral indicators directly mentioned in the content include Google Drive-based C2, encrypted file-based tasking via the extensions .cab, .pdf, .rar, .7z, .bak, and .png, and association with Silver Dragon/APT41-linked operations.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Its custom backdoor, GearDoor, routes command-and-control traffic through Google Drive, disguising malicious communication as routine cloud usage.
Its custom backdoor, GearDoor, routes command-and-control traffic through Google Drive, disguising malicious communication as routine cloud usage.
"...Silver Dragon deployed GearDoor, a new backdoor which leverages Google Drive as its command-and-control (C2) channel..."
Techniques & procedures
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Enterprise edge network devices such as routers, firewalls, and VPN appliances have become the primary exploitation surface for PRC-linked threat actors... confirmed exploitation of vulnerabilities in Ivanti Connect Secure, Palo Alto Networks PAN-OS, multiple Cisco IOS XE products, Fortinet, Juniper, SonicWall, Nokia, and Sierra Wireless devices.
Silver Dragon... exploits internet-facing servers and uses phishing for initial access... eCrime actors are exploiting these conditions opportunistically by weaponizing conflict narratives through targeted phishing and fake humanitarian content to deliver infostealers and backdoors.
Execution
6 techniques
Execution
"LNK files that triggered PowerShell commands, dropping additional malware components".
"...launch PowerShell code by means of 'cmd.exe'" ... "run commands via 'cmd.exe' or scheduled tasks"
Persistence
1 technique
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
5 techniques
Stealth
“strings are entirely obfuscated using a Brainfuck-based string decryption routine… control flow flattening and inserting junk code…”
GearDoor command list includes “steal_token <pid> Impersonates the security token…” and SilverScreen “relaunches itself… using token impersonation.”
"malicious Windows shortcut files and DLL-based persistence techniques" and "load malicious DLLs".
Discovery
5 techniques
Discovery
GearDoor supported commands include “ipconfig”, “netstat”, “ps” and directory listing operations.
GearDoor command list includes “ps None Lists running processes on the system.”
Collection
1 technique
Collection
Command and Control
8 techniques
Command and Control
Its custom backdoor, GearDoor, routes command-and-control traffic through Google Drive, disguising malicious communication as routine cloud usage.
"GearDoor, a backdoor that communicates with command-and-control infrastructure through Google Drive."
Its custom backdoor, GearDoor, routes command-and-control traffic through Google Drive, disguising malicious communication as routine cloud usage.
“...GearDoor, a new backdoor which leverages Google Drive as its command-and-control (C2) channel…”
"...leveraged a dedicated Google Drive account as command-and-control infrastructure for its GearDoor backdoor..."
"...uses ... Google Drive-based command-and-control" ... "GearDoor, a .NET backdoor, uses Google Drive as a command-and-control channel"
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A custom backdoor used to disguise C2 traffic as normal Google Drive activity, supporting stealthy persistence and blending into legitimate cloud usage.
Backdoor used for remote access and post-compromise control; used alongside tooling for command execution and screen capture.
A backdoor that uses Google Drive as a C2 channel to blend malicious communications into trusted cloud traffic.
Backdoor used for cyberespionage, leveraging Google Drive as command-and-control (C2) infrastructure to blend in with trusted cloud traffic and reduce detection.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.