China APT UNC5174 Hijacks Discord API as Covert C2 Channel to Evade Detection and Conduct Espionage

A Chinese state-sponsored threat group, UNC5174, has been linked to a sophisticated cyber-espionage operation that hijacks the Discord API as a covert command-and-control channel to evade detection, according to ASEC. The campaign deploys a backdoor malware masquerading as a Discord bot to maintain persistent access, with the bot built on the DiscordGo library and the bot token and server ID encrypted within the binary.

Once active, the malware connects to the attackers’ Discord server and uses the MessageCreate event handler to issue commands such as running arbitrary system commands, uploading and downloading files, and collecting sensitive system information. As of late November 2025, the malware’s VirusTotal detection rate was 1/64, underscoring its stealth.

UNC5174, believed to be a contractor for China’s Ministry of State Security, reportedly begins with a known backdoor like vshell and then sequentially deploys multiple backdoors to avoid detection, using Discord traffic to blend with normal user activity. The report notes the group’s previous exploits against F5 BIG-IP and ScreenConnect vulnerabilities.