China-linked APT41 targets government, think tanks, and academics tied to US-China trade and policy

According to Proofpoint, the China-linked cyber espionage group TA415 impersonated a U.S. lawmaker in phishing campaigns targeting government, think tanks, and academics tied to U.S.-China trade and policy. In July and August 2025, TA415 presented themselves as the Chair of the Select Committee on Strategic Competition between the United States and the CCP and as the US-China Business Council to persuade targets focused on U.S.-China relations, trade and economic policy.

The group runs phishing campaigns that use VS Code Remote Tunnels alongside legitimate services such as Google Sheets and Calendar to achieve persistent remote access, blending with normal traffic to avoid detection. A password-protected archive used in the operation contains an LNK that launches a logon.bat from a hidden _MACOS_ folder and decoy PDF, with a batch that loads a Python loader (WhirlCoil) and installs the VS Code Remote Tunnel, enabling remote access to the host.

TA415 has been described as operating from Chengdu as Chengdu 404 Network Technology, with links to other contractors and possible ties to Chinese state interests; Proofpoint also attributes Voldemort backdoor activity to TA415 with high confidence.