APT41-Linked Silver Dragon Targets Governments Using Cobalt Strike and Google Drive C2

Cybersecurity researchers disclosed an advanced persistent threat named Silver Dragon—linked to APT41—that has conducted targeted campaigns against government and other entities in Europe and Southeast Asia since at least mid‑2024. The group uses public‑facing server exploits and phishing to gain access, then employs three primary infection chains (AppDomain hijacking, service DLL/BamboLoader, and LNK-based phishing) to deploy Cobalt Strike beacons. Post‑exploitation includes custom loaders (MonikerLoader, BamboLoader), backdoors and tools (SilverScreen, SSHcmd, GearDoor) that use Google Drive for file-based C2, with diverse plugins and file-extension conventions for tasking and exfiltration.