China APT Infiltrates US Policy Nonprofit in Months-Long Espionage Campaign Using DLL Sideloading

A new investigation by the Broadcom Threat Hunter Team has uncovered a China-linked cyber espionage campaign that infiltrated a U.S.-based nonprofit organisation involved in influencing U.S. government policy on international issues, with the intrusion persisting for several weeks in April 2025. The first signs of malicious activity appeared on 5 April 2025, when a mass scan targeted servers using exploits including CVE-2022-26134, CVE-2021-44228, CVE-2017-9805 and CVE-2017-17562.

After a dormancy period, activity surged on 16 April, incorporating external connectivity checks and internal IP probing, followed by the creation of a Windows scheduled task to maintain persistence. The attackers leveraged msbuild.exe to run malicious XML configurations hourly, using a signed vetysafe.exe component of Vipre Antivirus to sideload a malicious DLL named sbamres.dll, in a technique described as DLL sideloading.

The Broadcom Threat Hunter Team linked elements of the operation to Space Pirates, Kelp (Salt Typhoon), Earth Longzhi and APT41, noting the use of legitimate binaries and loader reuse across campaigns. Evidence suggests the attackers aimed to gain control over the organisation’s authentication infrastructure, including credential dumping tools and additional legitimate Microsoft files in their toolkit.