China-linked hackers target U.S. non-profit in long-term espionage campaign

China-linked hackers breached a U.S. policy-focused nonprofit in April 2025, gaining weeks of persistence before activity stopped in mid‑April, according to a report published by Symantec. The attackers used DLL sideloading via vetysafe.exe, a technique also associated with other China‑affiliated groups such as Space Pirates, Kelp and Earth Longzhi/APT41 subgroups.

They leveraged Imjpuexc, a Microsoft file for East Asian input, to mask their activity and sought long‑term access to the network, with targets including domain controllers to enable broader spread.

A mass scan on 5 April 2025 targeted servers with public exploits, and reconnaissance restarted on 16 April, during which attackers executed repeated curl commands to external sites and to a remote host, then enumerated TCP connections with netstat and established a persistent scheduled task at C:\Windows\Ras\Outbound running msbuild.exe as SYSTEM.

The intrusion culminated in the deployment of an encrypted payload loaded into memory via a custom loader and connected to a C2 server, with activity ceasing after 16 April.