China's APT41 crew adds a stealthy malware loader and fresh backdoor to its toolbox

Zscaler ThreatLabz researchers report that Chinese state-linked APT41 has very likely added a C-based shellcode loader called DodgeBox and a backdoor named MoonWalk to its toolkit; DodgeBox performs environment checks, disables protections (e.g., CFG), uses salted FNV1a hashes and AES-CFB for configuration, and decrypts and drops MoonWalk which uses Google Drive for C2, with observed targeting in Southeast Asia and medium-confidence attribution to APT41.