Silver Dragon is a Chinese state-sponsored Advanced Persistent Threat (APT) group assessed to be operating as a subgroup within the broader APT41 umbrella and also tracked as Winnti and Barium. APT41 is one of the most prolific Chinese hacking collectives on record, with documented cyber espionage activity dating back to 2012 spanning healthcare, telecommunications, high-tech manufacturing, education, travel services, and media. The group is further believed to engage in financially motivated operations that may operate partially outside direct state control.
Silver Dragon has been active since mid-2024, directing its operations primarily against government entities as well as organizations in the high-tech sector across Europe and Southeast Asia. Its attribution to the APT41 umbrella rests on observed overlaps in post-exploitation installation scripts and shared decryption mechanisms within its BamboLoader component with both of which have been previously documented in China-nexus threat activity.
Operationally, the group is distinguished by its high adaptability, its reliance on custom .NET-based loaders, and its deliberate use of “living off the land” techniques which a strategy where adversaries hijack legitimate Windows services and utilities to blend malicious activity into the normal background noise of a compromised system, making detection considerably more difficult.
Infection Vectors and Initial Access
Silver Dragon employs three distinct infection chains, each ultimately designed to deploy a Cobalt Strike beacon as its final payload that is a commercial adversary simulation framework widely abused by threat actors for persistent remote access and lateral movement within victim environments.
Chain A — AppDomain Hijacking (Post-Exploitation)
This chain is initiated following the compromise of a public-facing server, where a compressed RAR archive serves as the delivery vehicle. A batch script within the archive drops MonikerLoader, a .NET-based loader that decrypts and executes a second-stage payload entirely in memory hence bypassing disk-based security controls that would otherwise flag a suspicious file. The in-memory second stage then acts as a conduit to load the Cobalt Strike beacon directly into the running process.
Chain B — Service DLL (Persistence-Focused)
Also delivered via RAR archives on vulnerable servers, this chain prioritizes long-term persistence over stealth of entry. A batch script drops BamboLoader, a heavily obfuscated C++ shellcode loader that registers itself as a Windows Service so ensuring it survives system reboots. Once active, BamboLoader decrypts and decompresses shellcode stored on disk and injects it into a legitimate running process such as taskhost.exe. Notably, the target process is configurable within the loader itself, giving operators flexibility to blend into different host environments.
Chain C — Email-Based Phishing (Uzbekistan Campaign)
A targeted campaign against organizations in Uzbekistan employs malicious Windows Shortcut (LNK) files delivered as email attachments. When the victim opens the attachment, the LNK file uses cmd.exe to invoke PowerShell, which then extracts four components onto the system. A decoy document is displayed to the victim to reduce suspicion while the payload executes in the background. The remaining three files, a legitimate executable (GameHook.exe), a malicious BamboLoader DLL (graphics-hook-filter64.dll), and an encrypted Cobalt Strike payload (simhei.dat), work in concert through DLL side-loading: GameHook.exe, which is itself a trusted binary vulnerable to side-loading, loads the malicious DLL, which in turn decrypts and launches the Cobalt Strike beacon.
How FileDNA Helps Break This Attack Chain: This campaign demonstrates that the attack succeeds only after a malicious file reaches the endpoint and is executed. FileDNA’s Content Analysis, Disarm, and Reconstruction (CADR) technology is designed to disrupt that delivery stage by analyzing Windows Shortcut (LNK) files and the active content they contain before users ever interact with them. Rather than relying on signatures or prior knowledge of specific malware families, FileDNA identifies suspicious behaviors such as hidden command execution, PowerShell invocation, embedded script chains, and attempts to launch secondary payloads. By neutralizing or removing the active content while preserving the legitimate file where appropriate, FileDNA can prevent the LNK file from triggering the PowerShell downloader, blocking the subsequent DLL side-loading chain and Cobalt Strike deployment before the attack reaches the endpoint.
Command and Control and Post-Exploitation Toolset
Beyond Cobalt Strike, Silver Dragon deploys a suite of custom .NET tools to conduct data exfiltration, maintain persistent access, and monitor victim activity. This purpose-built toolset reflects the group’s investment in bespoke capabilities that can be adapted to specific operational requirements.
SilverScreen
SilverScreen is a .NET-based monitoring utility that captures periodic screenshots of the victim’s desktop and tracks precise cursor movements over time. This provides operators with passive visual intelligence on user activity, open applications, and sensitive data displayed on screen hence without requiring any direct interaction with the host.
SSHcmd
SSHcmd is a command-line utility that enables remote command execution and bidirectional file transfers over SSH. It provides operators with a reliable secondary access channel that operates over a legitimate, encrypted protocol, complicating efforts to distinguish malicious traffic from authorized administrative activity.
GearDoor
GearDoor is Silver Dragon’s most sophisticated post-exploitation .NET backdoor that routes all command-and-control (C2) communication through Google Drive. By authenticating to a rogue Google Drive account, GearDoor masks its C2 traffic within legitimate cloud storage traffic, effectively circumventing traditional network security filters and firewall rules that are unlikely to block Google’s infrastructure.
GearDoor’s communication protocol assigns specific operational roles to file extensions, enabling operators to issue commands, transfer files, and deploy in-memory plugins through what appears to be routine cloud file activity:
| Extension | Functionality | Result Format |
| *.png | Sends heartbeat files containing basic host identification data. | N/A |
| Receives commands for directory listing and directory creation/removal. | *.db | |
| *.cab | Gathers host information and process lists; executes cmd.exe commands. | *.bak |
| *.rar | Receives payloads; if named wiatrace.bak, triggers a self-update routine. | *.bak |
| *.7z | Receives and executes plugins directly in memory without writing to disk. | *.bak |
Of particular note is the self-update mechanism triggered when a payload file is named wiatrace.bak — allowing operators to silently update the implant on a live host without redeploying the full infection chain.
Detection Evasion Techniques
Silver Dragon demonstrates a mature understanding of enterprise security architectures and applies a layered evasion strategy across all stages of its operations.
DNS tunneling is used to conceal C2 communication within standard DNS query traffic within a protocol that many security tools monitor less rigorously than HTTP or HTTPS. By encoding commands and responses within DNS requests, the group can maintain persistent C2 channels even in heavily monitored network environments.
The group’s broader living-off-the-land approach extends this philosophy further: by hijacking legitimate Windows services and processes rather than deploying overtly malicious executables, Silver Dragon ensures that its activity is difficult to distinguish from normal system behavior. Process injection into trusted binaries like taskhost.exe means that even endpoint security solutions may fail to flag the running process as hostile.
At the code level, BamboLoader employs extensive C++ obfuscation to resist static analysis, while MonikerLoader’s in-memory execution model ensures that no second-stage payload is ever written to disk — eliminating one of the most common artifact sources for forensic investigation and antivirus scanning. Together, these techniques reflect the work of a well-resourced, operationally disciplined threat group that continuously evolves its capabilities to outpace defensive controls.
Assessment
Silver Dragon represents a capable and evolving threat actor operating under the cover of one of the most active Chinese state-sponsored groups on record. Its use of diverse vulnerability exploits, custom loaders with layered obfuscation, and cloud-based C2 infrastructure through Google Drive signals both technical sophistication and a deliberate effort to stay ahead of the security community. Organizations in government, healthcare, telecommunications, and high-tech sectors — particularly those in Europe and Southeast Asia – should treat Silver Dragon as an active and credible threat.
References:
CheckPoint Silver Dragon Targets Organizations in Southeast Asia and Europe
The Hacker News APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2
Dark Reading China’s Silver Dragon Razes Governments in EU, SE Asia
Security Affairs From phishing to Google Drive C2: Silver Dragon expands APT41 playbook
Offensive Security Threat Radar Silver Dragon Threat Summary