[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgryID-qmWNNUQPjjDpPXbBwnvy5O-o0i1PWA20LyzKU":3},{"article":4,"iocs":54,"watch_terms":77,"solutions":78,"lesson":35},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"8a2e1bdf-9ffa-4e64-b492-25c615f4e6ef","China-Linked Twill Typhoon Uses Fake Apple and Yahoo Sites for Espionage","china-linked-twill-typhoon-uses-fake-apple-and-yahoo-sites-for-espionage-4c9593","A new Darktrace report reveals how Chinese hackers use fake Apple and Yahoo sites and the FDMTP malware framework to spy on organisations.","Darktrace discovered a sustained cyberattack campaign by Chinese threat group Twill Typhoon targeting organizations across Japan and Asia-Pacific since September 2025. The attackers use DLL sideloading with legitimate tools (Sogou Pinyin, Windows utilities) and fake CDN domains (yahoo-cdn.it.com, icloud-cdn.net) to maintain persistent access via the FDMTP malware framework. The modular approach allows attackers to deploy plugins and evade detection by mimicking normal system behavior.","China-linked Twill Typhoon uses fake Apple and Yahoo CDN sites with FDMTP malware to spy on Asia-Pacific organizations.","https:\u002F\u002Fhackread.com\u002Fchinatwill-typhoon-fake-apple-yahoo-sites-espionage\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002Fchinatwill-typhoon-fake-apple-yahoo-sites-espionage.jpg","2026-05-14T10:32:00+00:00","2026-05-14T12:00:21.409543+00:00",9,[17,20,23,25,28,31],{"name":18,"type":19},"Twill Typhoon","threat_actor",{"name":21,"type":22},"Apple","vendor",{"name":24,"type":22},"Yahoo",{"name":26,"type":27},"Sogou Pinyin","product",{"name":29,"type":30},"DLL sideloading","technology",{"name":32,"type":22},"Darktrace","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65,68,71,74],{"type":56,"value":57,"context":58},"domain","yahoo-cdn.it.com","Fake Yahoo CDN domain used in spear-phishing and command delivery",{"type":56,"value":60,"context":61},"icloud-cdn.net","Fake Apple iCloud CDN domain used for malware callback and command retrieval",{"type":48,"value":63,"context":64},"FDMTP","Modular remote access framework used by Twill Typhoon for persistent command and control",{"type":48,"value":66,"context":67},"dnscfg.dll","Remote control module within FDMTP framework",{"type":48,"value":69,"context":70},"Assist.dll","Plugin module deployed via FDMTP",{"type":48,"value":72,"context":73},"Persist.WpTask.dll","Persistence plugin for scheduled task execution",{"type":48,"value":75,"context":76},"browser_host.dll","Malicious DLL sideloaded via Sogou Pinyin legitimate executable",[21,24,32],{"controls":79,"vendors":158},[80,101,130],{"slug":81,"name":82,"problem":83,"products":84},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[85,93],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":102,"name":103,"problem":104,"products":105},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":131,"name":132,"problem":133,"products":134},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[135,143,150],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":144,"vendor_name":32,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[159],{"slug":144,"name":32,"logo_path":145,"roles":160},[161],"reported_by"]