From Log4j to IIS, China’s Hackers Turn Legacy Bugs into Global Espionage Tools

A China-linked threat actor has been attributed to a cyber attack on a U.S. non-profit organisation, with the aim of establishing long-term persistence as part of broader activity against U.S. policy-linked organisations, according to Broadcom's Symantec and Carbon Black teams.

The first signs appeared on 5 April 2025, when mass scanning targeted a server using known exploits including CVE-2022-26134, CVE-2021-44228, CVE-2017-9805 and CVE-2017-17562; by 16 April 2025, attackers had run curl commands to test connectivity and used netstat to collect network information, then set up a persistence mechanism via a scheduled task.

The operation reportedly used msbuild.exe to run a payload and create another scheduled task to run every 60 minutes as SYSTEM, with a loader to inject into csc.exe and communicate with a C2 server, while also sideloading a DLL loader to conceal payloads and employing tools such as Dcsync and Imjpuexc.

Broadcom said a copy of the malicious DLL had been used in incidents linked to Salt Typhoon (Earth Estries) and to Earth Longzhi, a sub-cluster of APT41, and noted that Space Pirates had previously used a variant of this component.

In related research, Elastic Security Labs described TOLLBOOTH (HijackServer) being deployed via misconfigured IIS servers, with hundreds of infections reported, and HarfangLab highlighted APT groups such as GhostRedirector, Operation Rewrite, FamousSparrow, SinisterEye and PlushDaemon using diverse tactics including SEO cloaking, AitM, and module persistence to target IIS, domain controllers and other high‑value targets.

The researchers emphasised that the activity shows a trend of shared tooling and persistent, unauthenticated command channels across Chinese threat actors.