Chinese APT Campaign Targets Entities with Updated FDMTP Backdoor
Beginning in late September 2025, multiple affected hosts were observed making requests to domains impersonating content delivery networks (CDNs), including infrastructure masquerading as Yahoo- and Apple-affiliated services. Across these cases, Darktrace identified a consistent behavioral execution pattern: the retrieval of legitimate binaries alongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.
Pulse ID: 6a0b6898afd39bdd2dd6f142
Pulse Link: https://otx.alienvault.com/pulse/6a0b6898afd39bdd2dd6f142
Pulse Author: AlienVault
Created: 2026-05-18 19:29:26
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #CDN #Chinese #CyberSecurity #DNS #Darktrace #InfoSec #NET #OTX #OpenThreatExchange #RAT #RemoteAccessTrojan #SideLoading #Trojan #bot #AlienVault










