The Silent Spy: How Chinese Hackers are Exploiting U.S.-China Policy

TA415, the state-aligned Chinese threat actor also known as APT41, Brass Typhoon and Wicked Panda, has launched a series of spearphishing campaigns targeting U.S. government, think tank, and academic organisations in July and August 2025, according to Proofpoint. The activity marks a strategic pivot toward intelligence collection on U.S.-China economic relations and trade policy, with emails inviting recipients to closed-door briefings or to comment on draft legislation regarding sanctions against China.

The attackers impersonated entities such as the U.S.-China Business Council and even spoofed John Moolenaar, the chair of a U.S. committee, to exploit trust linked to public profiles, and used password-protected attachments hosted on Zoho WorkDrive, Dropbox or OpenDrive to bypass security.

The infection chain evolved from earlier Voldemort deliveries to a stealthier approach using legitimate developer tools, including the VS Code CLI, and established a VS Code Remote Tunnel for covert remote access, with persistence via scheduled tasks running every two hours.

According to Proofpoint, TA415 has historically used Google Sheets, Google Calendar and other trusted cloud services for command-and-control, and operates out of Chengdu, China, under the company Chengdu 404 Network Technology, with historic links to China’s Ministry of State Security.