China-Linked Threat Actor Taps 'Peculiar' Malware to Evade Detection

Trend Micro researchers observed Earth Freybug (linked to APT41) deploying a new DLL malware called UNAPIMON that unhooks Windows API functions to prevent sandboxing and antivirus tools from monitoring child processes; the attack chain included code injection into vmstools.exe, creation of scheduled tasks running batch scripts, and DLL side-loading via the SessionEnv service to drop and execute the payload for stealthy persistence and defense evasion.