Learn how #cyberespionage group #EarthFreybug uses DLL hijacking and API unhooking to prevent child processes from being monitored via a new malware type we’ve dubbed UNAPIMON.

Details in our latest blog entry: https://research.trendmicro.com/4adcpbP

Trend Micro reported on the attack chain of a cyberespionage group Earth Freybug, which they claim is a subset of the Chinese state-sponsored APT41 (Winnti Group). No information about the targets or timeline, but they describe a new UNAPIMON malware used for defense evasion ( prevent child processes from being monitored). One SHA256 provided, which isn't recognized in VirusTotal. 🔗 https://www.trendmicro.com/en_us/research/24/d/earth-freybug.html

#China #cyberespionage #EarthFreybug #APT41 #Winnti #UNAPIMON #threatintel #IOC