Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks

SecurityWeek reports that APT24, also known as G0011, Pitty Panda and Pitty Tiger, has been deploying a custom C++ first-stage downloader dubbed BadAudio to drop additional payloads as part of a multi-year cyber-espionage operation. The campaign has progressed from spear-phishing and social engineering to include strategic web compromises and supply-chain attacks, notably a July 2024 compromise of a regional digital marketing firm in Taiwan that affected over 1,000 domains.

BadAudio is delivered as a DLL and uses search order hijacking for execution, with recent incidents dropping archives containing VBS, BAT and LNK files to aid persistence and DLL sideloading. In one attack, BadAudio deployed a Cobalt Strike beacon bearing a watermark seen in another APT24 operation, though it is unclear if this was used in all incidents.

Since November 2022, the group has compromised at least 20 websites by injecting malicious JavaScript to target Windows systems, followed by a pop-up prompting users to download BadAudio; in August, conditions were removed and 1,000 sites loaded the malicious script. According to GTIG, this nearly three-year campaign demonstrates the evolving sophistication of China-nexus threat actors and their use of supply chain compromise and cloud-service abuse for persistent espionage.