Google exposes BadAudio malware used in APT24 espionage campaigns

APT24 (China‑linked) ran a three‑year targeted espionage campaign (Nov 2022–Sep 2025) delivering a heavily obfuscated loader named BadAudio via watering‑hole infections, supply‑chain compromise of a Taiwanese marketing firm (impacting ~1,000+ domains), and spearphishing lures. BadAudio uses control‑flow flattening, DLL search‑order hijacking, AES‑encrypted staging and C2, and has been observed loading Cobalt Strike; many samples remained poorly detected by antivirus, enabling persistent and stealthy intrusions.