APT24 has carried out a persistent three-year campaign using BadAudio, a stealthy first-stage downloader that gives long-term access to targeted networks. The group shifted from broad watering hole attacks to highly focused operations against Taiwan-based organizations. Analysts confirmed that BadAudio uses advanced obfuscation, encrypted payload delivery, and system fingerprinting to avoid detection. The operation also blends supply chain compromises and social engineering, showing deliberate intent to bypass traditional defenses.
Relevant Source (Google Cloud – Google Threat Intelligence): Beyond the Watering Hole: APT24’s Pivot to Multi-Vector Attacks
This report details APT24’s three-year BadAudio campaign, including its role as an obfuscated C++ first-stage downloader, use of watering hole and supply chain attacks, and focused targeting of Taiwan-based organizations.
Quick Facts
- China-linked APT24 ran a multiyear BadAudio malware campaign.
- Attackers weaponized 20 or more legitimate websites with malicious JavaScript.
- BadAudio quietly fingerprints systems and exfiltrates data through encrypted cookies.
- Payloads include AES-encrypted Cobalt Strike Beacon variants.
- Supply chain breaches hit digital marketing firms in Taiwan.
- Phishing campaigns used trusted cloud platforms for malware delivery.
BadAudio Overview
APT24’s BadAudio malware acts as a custom first-stage downloader that blends stealth, encryption, and flexible delivery paths. The malware was written in C++ and uses tightly obfuscated logic to hide its behavior from security tools. The group injected malicious JavaScript into legitimate websites, redirecting selected visitors to attacker servers based on fingerprinting data. This mix of broad reach and selective targeting allowed the operation to run quietly for years.
- Deploys through malicious DLLs placed using search order hijacking
- Exfiltrates host details through encrypted browser cookies
- Uses hardcoded AES keys to decrypt secondary payloads
BadAudio’s design shows a long-term effort to maintain access and launch deeper intrusion stages without obvious triggers.
Relevant Source (The Hacker News): APT24 Deploys BADAUDIO in Years-Long Espionage Campaign
This article summarizes Google’s research on APT24, detailing BadAudio’s stealthy design, use of watering hole attacks, encrypted cookie exfiltration, and multi-vector delivery that targets organizations in Taiwan.
Threat Impact
APT24’s sustained activity with BadAudio signals a wider push toward harder-to-detect initial access operations. The campaign evolved from wide-net infections to precision-targeted attacks against Taiwanese organizations that rely on cloud storage, marketing vendors, and routine web traffic. Analysts observed that the malware’s advanced obfuscation methods reduce the value of signature-based detection and place greater pressure on behavioral analysis.
- Watering hole attacks weaponized popular public sites
- Supply chain breaches created multi-victim compromises
- Cobalt Strike Beacon enabled remote command access
- Malware hid in legitimate cloud platforms
- Phishing lures exploited organizational trust
Organizations facing regional or political targeting should treat this activity as a sign that attackers will keep adapting until defenses shift.
Relevant Source (CISA): Tactics, Techniques, and Procedures of Indicted State-Sponsored Cyber Actors
This advisory describes how state-backed actors use Spearphishing, watering hole, and supply chain intrusions for long-term access, reinforcing the need for behavioral detection against advanced campaigns like APT24’s.
What To Do Now
Security teams should assume that multi-vector attack paths are part of APT24’s long-term strategy and respond with layered defenses. Focus on detection methods that highlight abnormal behavior rather than relying only on static signatures. Review external vendor relationships, confirm integrity checks for marketing and web assets, and limit script execution for untrusted domains.
Actions to take:
- Monitor for DLL search order hijacking and unsigned DLL loads
- Inspect web code for unauthorized JavaScript injections
- Audit cloud storage access logs for unusual downloads or uploads
- Block known malicious infrastructure and analyze outbound cookie data
- Strengthen email filtering and validate sender identities
These steps reduce exposure to the specific methods APT24 used to maintain persistence across multiple organizations.
Relevant Source (CISA): Technical Approaches to Uncovering and Remediating Malicious Activity
This advisory outlines behavioral detection, logging, and remediation techniques for advanced intrusions, aligning with guidance to monitor anomalies, review logs, and use layered defenses.
Relevant Source (Microsoft): Secure Loading of Libraries to Prevent DLL Preloading Attacks
This article details how to harden systems against DLL search order hijacking and unsafe library loading, directly supporting recommendations to monitor and control malicious DLL execution.
The Big Picture
APT24’s BadAudio campaign highlights a broader shift in state-linked cyber operations toward blending technical stealth with social engineering and supply chain disruption. Attackers are increasingly using legitimate services and trusted relationships to hide malware delivery. The group’s evolution toward more targeted tactics shows a clear understanding of how to reach high-value networks without raising early alarms.
Security teams must prepare for operations that evolve over several years and continue to adapt. BadAudio’s use of encrypted payloads, fingerprinting, and selective victim engagement suggests that future campaigns will rely even more on cross-platform delivery and operational flexibility. Long-term monitoring, vendor risk assessment, and script integrity checks now play a far greater role in defending against advanced threat actors.
Relevant Source (NSA / CISA): PRC State-Sponsored Actors Compromise and Maintain Network Access Through “Living off the Land” Techniques
This joint advisory describes how Chinese state-linked actors use stealthy techniques, valid tools, and trusted relationships to hide long-term intrusions, reinforcing the need for persistent monitoring and supply chain awareness described in this section.
Final Thoughts
BadAudio marks a significant rise in operational discipline for APT24. The campaign shows that attackers can combine multiple delivery channels, hide inside trusted platforms, and maintain persistent access for extended periods. Organizations that build strong behavioral detection, tighten supply chain controls, and limit trust boundaries stand a better chance of identifying these threats before deeper compromise occurs.
Common Questions
What Is BadAudio?
BadAudio is a first-stage downloader used by APT24 to collect system details, deliver encrypted payloads, and maintain early access inside victim networks.
How Did Attackers Deliver The Malware?
Delivery occurred through web compromises, spear-phishing, cloud file sharing, and supply chain breaches tied to digital marketing vendors.
What Type Of Payloads Were Deployed?
Security analysts confirmed that BadAudio delivered Cobalt Strike Beacon variants decrypted from AES-encrypted archives.
Why Were Taiwan-Based Organizations Targeted?
Researchers noted a shift toward precise targeting of Taiwanese entities, though attribution motives were tied to known APT24 regional focus rather than public documentation of intent.
How Can Organizations Detect BadAudio?
Monitoring for DLL hijacking, unexpected cookie exfiltration, unauthorized JavaScript injections, and anomalous cloud activity increases the chance of early detection.
How JENI Strengthens Your Security Posture
Modern threats demand tools that keep systems clean, stable, and predictable. JENI helps by reducing the noise that attackers rely on when they try to hide inside cluttered or misconfigured environments. A healthier system baseline makes abnormal behavior easier to spot and easier to investigate.
What JENI Improves
- Real-time cleanup that removes system clutter before it creates blind spots
- Automated checks that identify background drains and unusual system activity
- Smart monitoring that keeps performance stable and reduces opportunities for threat persistence
JENI supports a safer environment by cutting down on the small issues that attackers exploit. A tuned device reacts faster during security events and handles monitoring tools more efficiently. The reduced overhead helps security teams focus on genuine anomalies instead of routine slowdowns. JENI reinforces long-term stability in a way that aligns with strong cybersecurity hygiene.
