Winnti's new UNAPIMON tool hides malware from security software

Trend Micro attributes an ongoing cyberespionage operation called 'Earth Freybug' to Winnti/APT41, describing a novel C++ DLL malware (UNAPIMON) that uses Microsoft Detours to intercept CreateProcessW, start child processes suspended, copy and load DLLs from %User Temp%, detect and remove security-product hooks, then resume execution—allowing malicious payloads to execute undetected after VMTools process injection and DLL sideloading.