CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Silver Dragon APT41-Linked Group Targets Governments with Cobalt Strike and Google Drive C2

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

The Silver Dragon APT group, linked to APT41, has been targeting government entities in Europe and Southeast Asia since mid-2024. The group exploits public-facing servers and uses phishing emails with malicious attachments for initial access. They maintain persistence by hijacking legitimate Windows services and use Cobalt Strike beacons, DNS tunneling, and Google Drive for command-and-control (C2) communication. The group employs multiple infection chains, including AppDomain hijacking, service DLL, and email-based phishing, to deliver Cobalt Strike payloads. The group's activities include the use of custom tools like SilverScreen for screen monitoring, SSHcmd for remote command execution, and GearDoor for backdoor communication via Google Drive. The backdoor uses various file extensions to indicate different tasks and communicates with an attacker-controlled Google Drive account.

Timeline

  1. 04.03.2026 10:14 1 articles · 4h ago

    Silver Dragon APT41-Linked Group Targets Governments with Cobalt Strike and Google Drive C2

    Since mid-2024, the Silver Dragon APT group has been targeting government entities in Europe and Southeast Asia. The group exploits public-facing servers and uses phishing emails with malicious attachments for initial access. They maintain persistence by hijacking legitimate Windows services and use Cobalt Strike beacons, DNS tunneling, and Google Drive for C2 communication. The group employs multiple infection chains, including AppDomain hijacking, service DLL, and email-based phishing, to deliver Cobalt Strike payloads. The group's activities include the use of custom tools like SilverScreen for screen monitoring, SSHcmd for remote command execution, and GearDoor for backdoor communication via Google Drive. The backdoor uses various file extensions to indicate different tasks and communicates with an attacker-controlled Google Drive account.

    Show sources
    Open in new tab

Information Snippets