China-Linked APT24 Runs BadAudio Espionage on Taiwan

A China-linked hacking group known as APT24 has conducted a nearly three-year cyberespionage campaign targeting organizations in Taiwan, employing a custom malware loader called BadAudio to gain persistent access to victim networks, according to researchers from Google Threat Intelligence Group.

The operation, active since November 2022 and continuing through at least early September 2025, has evolved from broad website compromises to more targeted supply chain attacks and spearphishing efforts. APT24, which has been linked to espionage activities dating back to 2008, primarily focuses on sectors including government, healthcare, telecommunications, and nonprofits in the United States and Taiwan. In this campaign, the group has compromised more than 20 legitimate websites, injected malicious JavaScript to fingerprint visitors, and selectively delivered BadAudio to Windows systems deemed valuable.

BadAudio functions as a first-stage downloader written in C, designed to evade detection through heavy obfuscation techniques such as control flow flattening, which fragments the code into small blocks managed by a dispatcher to hinder reverse engineering. Once executed, typically via...