# Chinese APTs Expand Targeting, Deploy Updated Backdoors in Sustained Campaign Wave


China-linked advanced persistent threat (APT) groups continue to evolve their tactics and expand their operational scope, with fresh evidence showing both Salt Typhoon and Twill Typhoon deploying new tools and targeting critical infrastructure sectors previously outside their typical focus areas. Security researchers tracking these campaigns warn that the activity represents not isolated breaches but sustained, adaptive operations designed to establish long-term access across multiple victim environments.


## The Emerging Threat


Between December 2025 and February 2026, security researchers at Bitdefender observed Salt Typhoon—one of China's most aggressive state-sponsored hacking groups—launching what appears to be a strategically motivated campaign against an Azerbaijani oil and gas company. The targeting marks a significant geographical and sectoral expansion for the APT, which has traditionally focused on U.S. government, telecommunications, and technology entities.


Simultaneously, the APT group known as Twill Typhoon has been conducting a prolonged campaign against organizations across the Asia-Pacific region since at least September 2025, armed with a newly developed modular remote access trojan (RAT) framework that researchers have dubbed FDMTP. These parallel operations underscore the increasing sophistication and resource allocation of Chinese cyber operations.


## Background and Context: Why Azerbaijan Matters Now


The Azerbaijani targeting appears strategically calculated rather than opportunistic. According to Bitdefender's analysis, Azerbaijan's recent elevation to a critical role in European energy security—driven by Russia's expiration of its gas transit agreement through Ukraine and ongoing disruptions in the Strait of Hormuz—has made the nation an attractive intelligence target for Chinese state interests.


Key context:

  • European nations have increased their reliance on Azerbaijani natural gas exports
  • This dependency creates both a geopolitical vulnerability and a valuable intelligence target
  • Salt Typhoon's traditional targeting of U.S. and Asian government/telecoms entities suggests the group is expanding operationally to track energy infrastructure relevant to broader geopolitical dynamics

    • The timing is not coincidental. APT campaigns are often driven by state intelligence priorities, and energy security decisions in Europe directly intersect with Chinese strategic interests in global supply chain resilience and sanctions evasion.


    ## The Salt Typhoon Campaign: Technical Execution


    ### Initial Compromise and Progression


    The intrusion chain followed a methodical approach typical of Salt Typhoon operations:


    Stage 1: Initial Access

  • Exploitation of Microsoft Exchange Server vulnerabilities (specifically the ProxyNotShell exploit chain)
  • Deployment of web shells to establish persistent command execution capability
  • The compromise occurred on a server within the Azerbaijani energy company's network

    • Stage 2: Lateral Movement and Escalation

  • Remote Desktop Protocol (RDP) abuse to pivot to a second server
  • Administrator account compromise enabling further exploration
  • Deployment of the Deed RAT backdoor—a remote access trojan that provides full command execution capabilities

    • Stage 3: Obfuscation and Persistence

    The attackers employed a sophisticated obfuscation technique: hiding the Deed RAT within a folder structure mimicking legitimate LogMeIn Hamachi software installation. A malicious service was registered under the Hamachi name, achieving persistence through a process that would execute automatically at system startup—a tactic that could evade detection during routine security scans that focus on suspicious service names.


    ### Sustained Access and Adaptation


    What distinguishes this campaign from typical intrusions is its adaptive, multi-wave nature:


  • January 2026: After security teams removed malware from at least one compromised host, the attackers returned and deployed TernDoor, a different backdoor previously attributed to Salt Typhoon by Cisco Talos researchers
  • February 2026: The group attempted to redeploy Deed RAT using the same exploitation chain, suggesting either a script-based reinfection process or determined hands-on-keyboard activity
  • Tools employed: Impacket framework for post-compromise network reconnaissance and additional compromises

    • "This intrusion should not be viewed as an isolated compromise, but as a sustained and adaptive operation conducted by an actor that repeatedly sought to regain and extend access within the victim environment," Bitdefender researchers noted—a critical distinction that indicates the attackers were treating the target as strategically important.


    ## The Twill Typhoon Campaign: New Modular Malware Framework


    ### Expanded Regional Targeting


    Twill Typhoon's campaign, tracked by Darktrace, began in September 2025 and continued through at least April 2026, targeting organizations across Asia-Pacific (APJ) and Japan. The group leveraged what researchers describe as an "updated arsenal," including the aforementioned FDMTP modular .NET-based RAT framework—a newly developed tool suggesting investment in bespoke malware development.


    ### The FDMTP Execution Chain


    The malware deployment followed a pattern common to Chinese APT campaigns:


    Delivery Mechanism:

  • Compromised hosts retrieved requests to domains impersonating legitimate content delivery networks (CDNs)
  • Attackers spoofed Yahoo and Apple CDN infrastructure to blend malicious traffic with legitimate network flows
  • The retrieval sequence combined legitimate binaries with matching .config files and malicious DLLs

    • Execution:

  • The FDMTP RAT framework was executed via DLL sideloading—a technique where legitimate Windows applications are tricked into loading malicious libraries from unexpected locations
  • During September and October 2025 campaigns, infected hosts repeatedly retrieved the same DLL from external attacker-controlled infrastructure
  • In April 2026, a financial organization's system within APJ was observed fetching legitimate binaries followed by repeated RAT framework retrieval attempts

    • The modular .NET architecture suggests the framework is designed for flexibility, allowing operators to load additional capabilities post-compromise—a feature that extends the effective lifespan of individual compromises and reduces the likelihood of complete malware removal.


    ## Implications for Organizations


    ### Critical Infrastructure at Risk


    Both campaigns target sectors essential to national security and economic stability:

  • Energy and utilities (Azerbaijan case)
  • Financial services (APJ region targeting)
  • Government and telecommunications infrastructure (traditional Salt Typhoon focus)

    • Organizations in these sectors should assume they are current targets of persistent Chinese APT activity.


    ### The Persistence Problem


    The Salt Typhoon campaign demonstrates a critical challenge: removing determined APTs requires more than endpoint security. The attackers returned multiple times using different backdoors and reinfection techniques, suggesting that:


    1. Initial malware removal is insufficient without comprehensive network remediation

    2. Lateral movement must be fully understood to identify all compromised systems

    3. Persistence mechanisms are redundant, with multiple backdoors providing fallback access


    ### Supply Chain and Attribution


    The reuse of known exploitation frameworks (ProxyNotShell), combined with deployment of previously identified backdoors (TernDoor), makes attribution more reliable but also suggests the actors are comfortable operating despite known indicators of compromise—a sign of confidence in their operational security or assessment that defenders lack detection capability.


    ## HackWire Analysis


    The escalation of Chinese APT targeting into Azerbaijan's energy sector reveals a critical convergence of geopolitics and cybersecurity that Western defenders have underestimated. Salt Typhoon's shift in targeting patterns wasn't random opportunism—it represents a deliberate strategic assessment that European energy diversification away from Russian sources creates a new intelligence imperative for Beijing.


    What's most concerning is the operational *pattern* these campaigns establish: persistent, multi-wave intrusions that treat malware removal as a temporary setback rather than a failure. Salt Typhoon's return to the same environment with different backdoors (Deed RAT replaced by TernDoor) indicates either an automated reinfection capability or an analyst-driven assessment that the compromise was worth revisiting. The former suggests malware design sophistication; the latter suggests geopolitical importance. Either way, it's a red flag for critical infrastructure.


    Twill Typhoon's FDMTP framework represents a smaller technical escalation but signals the same trend: modular, adaptable malware with multiple persistence mechanisms. These aren't the rough exploits of opportunistic cybercriminals—they're the tools of well-resourced state actors who can afford to develop custom malware for specific regional campaigns.


    For defenders, the lesson is uncomfortable: traditional incident response workflows (detect, contain, remove, verify) are insufficient against actors willing to return multiple times. Organizations in energy, finance, and government need to shift from treating breaches as discrete events to treating them as *campaigns* requiring sustained monitoring, threat hunting, and assumption of breach strategies. The Azerbaijani energy company likely thought the incident was resolved after the first cleanup—it wasn't.


    — HackWire Editorial


    ## Recommendations for Organizations


    Immediate Actions:

  • Patch Microsoft Exchange servers urgently if not completed, prioritizing ProxyNotShell vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207)
  • Audit RDP access logs for unusual lateral movement, particularly privileged account activity
  • Scan for DLL sideloading attempts in user-writable directories and application folders

    • Strategic Measures:

  • Implement persistent threat hunting rather than point-in-time incident response
  • Deploy endpoint detection and response (EDR) with behavioral analysis focused on execution chains (legitimate binary + DLL loading)
  • Establish network segmentation between critical infrastructure segments
  • Conduct supply chain security reviews for software update mechanisms that could be abused for malware delivery
  • Maintain immutable backup solutions separate from primary network access

    • Long-term Posture:

  • Assume compromise of critical systems and design security architecture accordingly
  • Rotate credentials on a shortened cycle (30 days) for high-value accounts
  • Implement multi-factor authentication with hardware keys for administrative access
  • Establish 24/7 security monitoring for critical infrastructure sectors

    • ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [APTs & State Actors](https://www.hackwire.news/category/apts-state-actors) and [Critical Infrastructure](https://www.hackwire.news/category/critical-infrastructure)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)