APT24 Utilizes BadAudio Malware for Cyberespionage

First seen 30 Nov 2025, 04:37 UTC • Securityaffairs.Co

•98% similarity •9

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

APT24 has been identified using BadAudio malware to enhance its cyberespionage capabilities through supply chain attacks. This malware targets various sectors, potentially affecting organizations that rely on compromised software components. The U.S. CISA has issued warnings regarding the threat posed by this malware.

ThreatCluster AI How this analysis works

Attack Flow

17 entities, 40 inferred relationships (STIX 2.1).

Threat Actor (2)

Apt24
Unc6384

Technique (4)

Data Breach
Malware
Supply Chain Attack
Zero-day Exploit

Campaign (1)

Samsung Spyware Attack

Organization (3)

French Soccer Federation
Mixpanel
Samsung

Malware (3)

Landfall
Badaudio
Badcandy

Affected Platform (3)

Cisco IOS XE
GoSign Desktop
Windows

Vulnerability (1)

FortiWeb

Relationships

Apt24 uses Landfall
Apt24 uses Badaudio
Apt24 uses Badcandy
Unc6384 uses Landfall
Unc6384 uses Badaudio
Unc6384 uses Badcandy
Apt24 uses Data Breach
Apt24 uses Malware
Apt24 uses Supply Chain Attack
Apt24 uses Zero-day Exploit
Unc6384 uses Data Breach
Unc6384 uses Malware
Unc6384 uses Supply Chain Attack
Unc6384 uses Zero-day Exploit
Landfall exploits FortiWeb
Badaudio exploits FortiWeb
Badcandy exploits FortiWeb
Samsung Spyware Attack attributed to Apt24
Samsung Spyware Attack attributed to Unc6384
Samsung Spyware Attack uses Landfall
Samsung Spyware Attack uses Badaudio
Samsung Spyware Attack uses Badcandy
FortiWeb targets Cisco IOS XE
FortiWeb targets GoSign Desktop
FortiWeb targets Windows
Apt24 targets French Soccer Federation
Apt24 targets Mixpanel
Apt24 targets Samsung
Unc6384 targets French Soccer Federation
Unc6384 targets Mixpanel
Unc6384 targets Samsung
Landfall targets French Soccer Federation
Landfall targets Mixpanel
Landfall targets Samsung
Badaudio targets French Soccer Federation
Badaudio targets Mixpanel
Badaudio targets Samsung
Badcandy targets French Soccer Federation
Badcandy targets Mixpanel
Badcandy targets Samsung

Community

Browse all →

Tracked Entities in This Story

Apt24 Unc6384 Landfall Badaudio Badcandy Samsung Spyware Attack French Soccer Federation Mixpanel Samsung Cisco IOS XE GoSign Desktop Windows

APT24 Utilizes BadAudio Malware for Cyberespionage

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story