Bleepingcomputer

APT24 Uses BadAudio Malware in Ongoing Espionage Campaign

First seen 20 Nov 2025, 23:19 UTC • •43.2

Article Content

1 / 7

Browse articles

ThreatCluster •March 12, 2026 at 13:27 UTC

APT24, a China-linked hacking group, has been utilizing a previously undocumented malware named BadAudio in a three-year espionage campaign. This malware has been delivered through various methods, including spearphishing and supply-chain compromises, affecting over 20 legitimate public websites from November 2022 to at least September 2025.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 217d ago How this analysis works

More articles in this cluster (6)

Threat Graph

16 entities, 18 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (1)

APT24

Technique (8)

Malware
Phishing
Supply Chain Attack
T1027 - Obfuscated/Compressed Files and Information
T1041 - Exfiltration Over C2 Channel
T1059.007 - JavaScript
T1059 - Command and Scripting Interpreter
T1071 - Command And Control

Campaign (1)

Badaudio Campaign

Malware (3)

Badaudio
Cobalt Strike
HoldingHands

Affected Platform (1)

Windows

Tool (2)

Google Drive
OneDrive

Relationships

APT24 uses Badaudio
APT24 uses Cobalt Strike
APT24 uses HoldingHands
APT24 uses Google Drive
APT24 uses OneDrive
APT24 uses Malware
APT24 uses Phishing
APT24 uses Supply Chain Attack
APT24 uses T1027 - Obfuscated/Compressed Files and Information
APT24 uses T1041 - Exfiltration Over C2 Channel
Badaudio Campaign attributed to APT24
Badaudio Campaign uses Badaudio
Badaudio Campaign uses Cobalt Strike
Badaudio Campaign uses HoldingHands
APT24 related to T1059.007 - JavaScript
APT24 related to T1059 - Command and Scripting Interpreter
APT24 related to T1071 - Command And Control
APT24 related to Windows

Following this threat?

Track APT24 and Badaudio in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…