China-linked APT17 Targets Italian Companies with 9002 RAT Malware

A China-linked APT17 conducted targeted spear-phishing campaigns against Italian companies and government entities in June–July 2024, using an MSI installer named "SkypeMeeting.msi" that runs a JAR via VBS to decrypt and execute shellcode that launches the modular 9002 RAT (Hydraq/McRAT). The malware provides network monitoring, screenshots, file enumeration, process management, and remote command execution, with the actor employing diskless variants and modular activation to evade interception.