Twill Typhoon FDMTP Campaign Targeting APJ Region

Darktrace has identified a persistent campaign linked to the Chinese-nexus actor Twill Typhoon (under the 'Crimson Echo' umbrella), primarily targeting entities in the Asia-Pacific & Japan (APJ) region. The activity involves a modular .NET-based Remote Access Trojan (RAT) framework, identified as an updated version of FDMTP (v3.2.5.1). The campaign is characterized by its use of legitimate binaries to sideload malicious DLLs and its reliance on infrastructure masquerading as well-known CDNs like Yahoo, Apple, and iCloud.

The attack chain begins with the retrieval of a legitimate executable (e.g., Sogou Pinyin's biz_render.exe or Windows ClickOnce's dfsvc.exe), followed by a matching configuration file and a malicious DLL. The threat actor leverages DLL sideloading and AppDomain hijacking to execute managed .NET code in-memory, minimizing its disk footprint. The FDMTP framework supports a modular architecture with various plugins for persistence, registry manipulation, and remote tasking over the Duplex Message Transport Protocol (DMTP).

This campaign demonstrates high technical proficiency in evading detection by utilizing trusted processes and encrypted configuration files. The shift toward modular, in-memory execution and the rotation of masqueraded CDN infrastructure necessitates a behavioral approach to detection rather than reliance on static indicators, as the execution sequence remains the most stable element of the threat actor's tradecraft.