China-Linked Twill Typhoon Uses Fake Apple and Yahoo Sites for Espionage
China-linked Twill Typhoon uses fake Apple and Yahoo CDN sites with FDMTP malware to spy on Asia-Pacific organizations.
Darktrace discovered a sustained cyberattack campaign by Chinese threat group Twill Typhoon targeting organizations across Japan and Asia-Pacific since September 2025. The attackers use DLL sideloading with legitimate tools (Sogou Pinyin, Windows utilities) and fake CDN domains (yahoo-cdn.it.com, icloud-cdn.net) to maintain persistent access via the FDMTP malware framework. The modular approach allows attackers to deploy plugins and evade detection by mimicking normal system behavior.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apple?
Get an email when a new story names Apple, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — yahoo-cdn.it.com
- domain — icloud-cdn.net
- malware — FDMTP
- malware — dnscfg.dll
- malware — Assist.dll
- malware — Persist.WpTask.dll
- malware — browser_host.dll