Silver Dragon APT Group Exploits Google Drive for Covert Attacks on Europe, Asia

Silver Dragon is a Chinese‑aligned APT group that has been targeting public sector and high‑profile organizations in Europe and Southeast Asia since at least mid‑2024, with strong operational overlap to APT41 tradecraft.

The group combines classic post‑exploitation tooling like Cobalt Strike with new custom malware that abuses Google Drive as a covert command‑and‑control (C2) channel.research.

Silver Dragon focuses on government ministries and public sector entities, primarily in Southeast Asia but also across parts of Europe, indicating a clear cyber‑espionage motive.

Analysts assess the actor as operating under the broader APT41 umbrella based on script similarity, overlap in Cobalt Strike configurations, and consistent UTC+8 compilation patterns.

The group relies on two main initial access vectors: exploitation of public‑facing internet servers and email‑based phishing that delivers malicious attachments, including weaponized LNK files.

Check Point Research (CPR) has been tracking a sophisticated Chinese-aligned threat group whose activity demonstrates operational correlation with campaigns previously associated with APT41.

Once a foothold is established, operators deploy Cobalt Strike beacons and often tunnel C2 traffic over DNS to evade perimeter monitoring and traditional HTTP‑centric detections.research.

Silver Dragon APT Group

CPR documented three primary infection chains: AppDomain hijacking, a Service DLL chain, and a phishing‑driven LNK chain, all converging on Cobalt Strike as the final payload.

The AppDomain hijacking path abuses .NET configuration files (for binaries such as dfsvc.exe and tzsync.exe) to redirect execution into a malicious loader dubbed MonikerLoader, which decrypts and executes staged shellcode purely in memory.

The Service DLL chain is more minimal and centers on BamboLoader, a heavily obfuscated x64 C++ loader registered as a Windows service by hijacking legitimate service names like Windows Update or Bluetooth services execution.

Install scripts stop and delete the original service, copy the malicious DLL into system paths, then recreate the service pointing to the attacker’s loader, a pattern previously documented in APT41 operations.

In the phishing chain, oversized LNK attachments embed PowerShell that extracts multiple payloads from the shortcut itself, drops a decoy PDF, and abuses a legitimate executable (GameHook.exe) for DLL sideloading of BamboLoader.

Across all chains, Cobalt Strike beacons use hybrid HTTP/DNS profiles, cracked watermarks, and, in some cases, SMB‑based lateral C2 inside victim networks.

GearDoor: Google Drive–based C2

The standout capability in Silver Dragon’s toolkit is GearDoor, a .NET backdoor that uses Google Drive as its primary C2 channel, effectively hiding malicious traffic inside a trusted cloud platform.

GearDoor employs Brainfuck‑style string obfuscation and DES encryption, deriving its keys from MD5‑based material and assigning each host a unique identifier that maps directly to a dedicated folder on Google Drive.

All tasking is file‑based: specific extensions (such as .png, .cab, .7z, .pdf, .rar, .db, .bak) signal heartbeat, command execution, plugin loading, file management, payload delivery, and status reporting, with files deleted after processing to reduce forensic artifacts.

This design allows operators to run full interactive command sets (whoami, ipconfig, ps, directory operations, token theft, and command execution) while blending into normal cloud usage patterns and bypassing simple domain‑ or IP‑based blocking.

Silver Dragon also operates SilverScreen, a .NET screen‑monitoring implant that captures multi‑monitor screenshots only when meaningful visual changes are detected, compressing them with JPEG plus GZIP to minimize noise and storage.

The tool impersonates active user sessions via token manipulation, enabling low‑profile surveillance inside government environments for extended periods.

Complementing this, SSHcmd is a .NET command‑line SSH wrapper built on the Renci.SshNet library, supporting direct command execution, interactive TTY, and file uploads/downloads with optional Base64‑encoded commands to evade basic logging.

Together, SilverScreen, SSHcmd, GearDoor, and the group’s custom loaders give Silver Dragon a versatile post‑exploitation toolkit that supports long‑term espionage across on‑prem and cloud‑integrated networks.

IOCs

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.