Chinese APT41 Upgrades Malware Arsenal with DodgeBox and MoonWalk

Zscaler ThreatLabz discovered DodgeBox, an improved variant of the StealthVector loader used by APT41 to deliver a modular backdoor named MoonWalk. DodgeBox employs DLL side-loading (via a signed taskhost.exe), DLL hollowing, call stack spoofing and other evasion techniques; MoonWalk leverages Windows Fibers, a plugin architecture, and a custom C2 protocol abusing Google Drive to blend with legitimate traffic. Samples were submitted from Thailand and Taiwan, and researchers assess the toolset as a sophisticated capability used for espionage and targeted intrusions.