BadAudio malware: how APT24 scaled its cyberespionage through supply chain attacks

China-linked group APT24 used supply-chain attacks and multiple techniques over three years to deploy the BadAudio downloader and additional malware payloads, according to Google Threat Intelligence Group. The researchers note a shift from broad web compromises to targeted operations in Taiwan, including repeated supply-chain compromises via a compromised marketing firm and spear-phishing.

BadAudio operates as a custom C++ first-stage downloader that retrieves an AES-encrypted payload from a fixed C2 server and executes it in memory, with the malware collecting basic system details and embedding them in a cookie value to fetch the next-stage payload; in some operations that payload is identified as Cobalt Strike Beacon and decrypted with the same AES key.

The malware uses heavy control-flow flattening and commonly arrives as a malicious DLL, relying on DLL search-order hijacking through legitimate executables, with newer versions packed in encrypted archives containing BAT, VBS and LNK files to set persistence and trigger sideloading.

The campaign has, over three years, evolved from broad compromises to focused supply-chain attacks and spear-phishing, with over 1,000 domains exposed in 2024 after the attackers compromised a Taiwanese digital marketing firm and reinfected it. The GTIG analysis highlights the sophistication of this multi-vector espionage and the actor’s capacity for persistent operations.