Unmasking Silver Dragon: The Chinese-Nexus APT Haunting Southeast Asia and Europe

Check Point Research attributes a sophisticated espionage campaign to a Chinese-nexus APT named Silver Dragon (linked to APT41) active since mid‑2024 against government and high-profile targets in Southeast Asia and Europe. The group uses multiple infection chains to deliver Cobalt Strike and a suite of custom tools—most notably the GearDoor .NET backdoor that leverages Google Drive for file-based C2—alongside screen-capture implants and obfuscated loaders, demonstrating high technical sophistication and stealth.