Twill Typhoon — Updated FDMTP Backdoor

Twill Typhoon (Mustang Panda / Earth Preta / Stately Taurus) is running an espionage campaign against APAC and Japanese entities — including finance-sector organizations — from late September 2025 through April 2026, deploying an updated build of the FDMTP modular .NET RAT (observed v3.2.5.1). The actor's objective is durable, low-noise remote access and intelligence collection from trusted-process context.

The core, durable behavior is DLL side-loading: the actor retrieves a legitimate, signed Windows executable, a matching .config file, and a malicious DLL from infrastructure masquerading as Yahoo- and Apple-affiliated CDNs, then lets the trusted binary load the rogue DLL. Confirmed abused binaries: biz_render.exe (Sogou Pinyin IME), vshost.exe (Visual Studio Hosting Process), and dfsvc.exe (.NET ClickOnce engine). The DLL pulls a .NET runtime in-process and stages the FDMTP framework, which communicates over a custom Duplex Message Transport Protocol (DMTP) with a /GetCluster registration URI and a Verify_Token: Dmtp header.

The highest-value defensive angle is behavioral, not indicator-based: the ordered sequence — signed EXE + .config + unsigned/unusual DLL written to the same directory, followed by that signed EXE making outbound HTTP to a young look-alike-CDN domain — survives infrastructure rotation and payload swaps. IOC hunts (the published hashes, the three domains, one IP) are included for immediate coverage but treated as perishable.

Defender priority: Hunt for signed Microsoft/Sogou binaries loading an unsigned or co-located DLL and then beaconing to look-alike CDN domains (*-cdn.it.com, icloud-cdn.net). A trusted process side-loading a freshly written DLL and immediately calling out is the single most reliable Twill Typhoon signal — anchor detection there, not on the rotating hashes.

Provenance note: Every atomic IOC in §4/§10 traces to Darktrace (hashes, IP, all three domains) corroborated by Industrial Cyber and Infosecurity Magazine. No IOCs were synthesized. Where an atomic value could not be sourced, the pack relies on behavioral detection instead.

Hunt hypotheses (ordered by fidelity)

1. H1 (high): A signed, legitimate binary (biz_render.exe, vshost.exe, dfsvc.exe) loads a DLL that was written to disk minutes earlier and/or resides in a non-standard path — classic side-load. T1574.002
2. H2 (high): One of the abused binaries (or any process) makes outbound HTTP to a look-alike CDN domain (*yahoo-cdn*, icloud-cdn[.]net, *-cdn.it.com). T1071.001 / T1036.005
3. H3 (high): Outbound request whose URI contains /GetCluster with protocol=DotNet-TcpDmtp or a Verify_Token: Dmtp header — FDMTP C2 registration. T1071.001
4. H4 (medium): Named malicious DLLs written to disk (dnscfg.dll, browser_host.dll, Client.TcpDmtp.dll, Client.DmtpFrame.dll, the VS sync DLL). T1105 / T1574.002
5. H5 (medium): Registry persistence under HKCU\Software\Microsoft\IME\{id} or the TypeLib COM CLSID, or scheduled-task creation by a side-loaded process. T1547.001 / T1053.005 / T1546
6. H6 (medium): Atomic IOC matches — published hashes, the three domains, IP 154.223.58[.]142. Perishable.
7. H7 (low): A non-browser, signed binary beaconing on a fixed ~5-minute interval (update-channel polling). T1071.001 / beacon cadence

Attack chain

All values below are reproduced verbatim from cited primary sources (Darktrace / Industrial Cyber / Infosecurity Magazine). Network IOCs are defanged. Infrastructure rotates — treat hashes/domains as perishable and lead with the behavioral hunts in §8.

Gap: The strongest C2 signatures (/GetCluster URI, Verify_Token: Dmtp header) live in HTTP request content. Without a proxy or TLS inspection, fall back to domain/IP + the side-load behavioral hunt (Q1/Q2).

Checks runnable without CQL, for tenants lacking full module-load or proxy telemetry:

• Sysmon Event ID 7 (Image Loaded): alert when biz_render.exe, vshost.exe, or dfsvc.exe load a DLL with Signed=false or a publisher other than the host binary's.
• Sysmon Event ID 11 (File Create): a .exe, a matching .config, and a .dll written to the same user-writable directory within a short window.
• Sysmon Event ID 13 (Registry Set): writes to HKCU\Software\Microsoft\IME\ sub-keys or the TypeLib CLSID {9E175B61-F52A-11D8-B9A5-505054503030} by a non-IME process.
• Windows Security 4698 (Scheduled Task Created): task registered with an action pointing at a user-profile path or one of the abused binaries.
• Web-gateway / proxy logs: any request to *yahoo-cdn*, icloud-cdn[.]net, *-cdn.it.com, or a URI containing /GetCluster / header Verify_Token: Dmtp.
• DNS resolver logs: resolutions of the three published domains or newly-registered *-cdn* look-alikes of Yahoo/Apple.

IOA-1 · Trusted binary side-loading from user-writable path

Rule type: Process Creation. Pattern: Image Filename matches (biz_render|vshost|vhost|dfsvc)\.exe AND Image Path under \Users\ / \AppData\ / \Temp\ / \ProgramData\. Action: Detect (escalate to Block after baseline). Exclusions: signed publisher update/installer directories.

IOA-2 · Network connection to FDMTP C2 URI signature

Rule type: Network Connection / DNS. Pattern: Domain matches yahoo-cdn\.it\.com / icloud-cdn\.net / -cdn\.it\.com. Action: Detect & alert. Exclusions: none expected; review the generic -cdn.it.com arm against your environment first.

IOA-3 · Named FDMTP DLL written to disk

Rule type: File Write. Pattern: Target filename matches the FDMTP DLL set in Q4. Action: Detect. Exclusions: exclude legitimate WindowsBase.dll in system paths.

Promotion path: Q1, Q2, Q4 are the strongest IOA candidates (high CONF, low/med FP). Q3/Q5/Q6 stay Investigate-only until baselined. Q7 is triage-aid only.

Grouped quick-copy blocks. All atomic values are sourced from the cited reports; defang is removed in the import-ready CSV.

type,value,action,severity,expiration,description,tags
domain,icloud-cdn.net,detect,high,2026-12-21,Twill Typhoon Apple-impersonating CDN,campaign:TwillTyphoon
domain,yahoo-cdn.it.com,detect,high,2026-12-21,Twill Typhoon Yahoo-impersonating CDN,campaign:TwillTyphoon
ipv4,154.223.58.142,detect,high,2026-09-21,Twill Typhoon C2/staging IP,campaign:TwillTyphoon
md5,fc3959ebd35286a82c662dc81ca658cb,detect,critical,2027-06-21,FDMTP staging archive Test.zip,campaign:TwillTyphoon
md5,b2c8f1402d336963478f4c5bc36c961a,detect,critical,2027-06-21,FDMTP dnscfg.dll sideload,campaign:TwillTyphoon
md5,c17f39d25def01d5c87615388925f45a,detect,critical,2027-06-21,FDMTP browser_host.dll sideload,campaign:TwillTyphoon
md5,482cc72e01dfa54f30efe4fefde5422d,detect,critical,2027-06-21,FDMTP Client.DmtpFrame.dll,campaign:TwillTyphoon
md5,c650a624455c5222906b60aac7e57d48,detect,critical,2027-06-21,FDMTP VisualStudio Sync DLL sideload,campaign:TwillTyphoon
md5,162F69FE29EB7DE12B684E979A446131,detect,critical,2027-06-21,FDMTP Persist.Extra,campaign:TwillTyphoon
md5,067FBAD4D6905D6E13FDC19964C1EA52,detect,critical,2027-06-21,FDMTP Persist.Registry,campaign:TwillTyphoon
md5,DF3437C88866C060B00468055E6FA146,detect,critical,2027-06-21,FDMTP Persist.WpTask,campaign:TwillTyphoon
md5,2CD781AB63A00CE5302ED844CFBECC27,detect,critical,2027-06-21,FDMTP Assist module,campaign:TwillTyphoon

Signed EXE (biz_render.exe / vshost.exe / dfsvc.exe) loads an
  unsigned or co-located DLL from a user-writable path  -> side-load
EXE + matching .config + DLL written to same dir within minutes  -> staging
HTTP URI contains:  /GetCluster?protocol=DotNet-TcpDmtp&tag=...&uid=...
HTTP request header:  Verify_Token: Dmtp
Look-alike CDN domains:  *yahoo-cdn*, icloud-cdn[.]net, *-cdn.it.com
~5-minute fixed-interval beacon from a non-browser signed binary
.NET CLR loaded in-process by a side-load host then memory-only stage

Backdoor:       FDMTP (modular .NET RAT, observed v3.2.5.1)
Abused legit:   biz_render.exe (Sogou Pinyin IME)
                vshost.exe / vhost.exe (Visual Studio Hosting)
                dfsvc.exe (.NET ClickOnce engine)
Malicious DLLs: dnscfg.dll, browser_host.dll, Client.TcpDmtp.dll,
                Client.DmtpFrame.dll, client.core.dll,
                Persist.WpTask.dll, Persist.registry.dll,
                Persist.extra.dll, Assist.dll, WindowsBase.dll,
                Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll
Config/stage:   dfsvc.exe.config, config.etl, checksum.bin/.etl,
                version.txt, Test.zip
Persistence:    HKCU\Software\Microsoft\IME\{id}
                HKCU\Software\Classes\TypeLib\{9E175B61-F52A-11D8-B9A5-505054503030}\1.0\1\Win64

# ASR rules relevant to this campaign (Defender)
# 56a863a9-875e-4185-98a7-b882c64b5ce5  Block untrusted/unsigned from USB
# 01443614-cd74-433a-b99e-2ecdc07bfc25  Block executables unless prevalence/age/trusted
# d1e49aac-8f56-4280-b9ba-993a6d77406c  Block process creations from PSExec/WMI
Get-MpPreference | Select -Expand AttackSurfaceReductionRules_Ids
Get-MpPreference | Select -Expand AttackSurfaceReductionRules_Actions
# Confirm SmartScreen + signature enforcement
Get-MpComputerStatus | Select AMRunningMode, RealTimeProtectionEnabled

P1 · Enable ASR rules (PowerShell)

# Block executables unless they meet prevalence/age/trusted-list criteria
Add-MpPreference -AttackSurfaceReductionRules_Ids 01443614-cd74-433a-b99e-2ecdc07bfc25 -AttackSurfaceReductionRules_Actions Enabled
# Block untrusted and unsigned processes that run from USB
Add-MpPreference -AttackSurfaceReductionRules_Ids 56a863a9-875e-4185-98a7-b882c64b5ce5 -AttackSurfaceReductionRules_Actions Enabled
# Verify
Get-MpPreference | Select-Object -ExpandProperty AttackSurfaceReductionRules_Ids

P2 · WDAC DLL-enforcement skeleton (block unsigned DLL loads)

# Build a base policy in enforced mode, then enable the option that also
# enforces DLL load rules (Option 0 + DLL enforcement). Pilot in Audit first.
$pol = "C:\WDAC\TwillTyphoon_DLLenforce.xml"
New-CIPolicy -FilePath $pol -Level Publisher -UserPEs -ScanPath C:\Windows
Set-RuleOption -FilePath $pol -Option 0          # Enabled:UMCI
Set-RuleOption -FilePath $pol -Option 3 -Delete  # remove Audit mode -> enforce
ConvertFrom-CIPolicy -XmlFilePath $pol -BinaryFilePath C:\WDAC\TwillTyphoon.cip
# Stage C:\WDAC\TwillTyphoon.cip via CI policy refresh / Intune; pilot ring first.

P3 · Block infrastructure (DNS sinkhole / hosts — pilot)

# Proxy/firewall block list (preferred). Sample hosts-level fallback:
0.0.0.0  yahoo-cdn.it.com
0.0.0.0  www.yahoo-cdn.it.com
0.0.0.0  icloud-cdn.net
0.0.0.0  www.icloud-cdn.net
# Firewall: deny egress to 154.223.58.142

⚠ Pilot before fleet-wide: WDAC DLL enforcement can break legitimate apps. Deploy in Audit, review CodeIntegrity/Operational 3076 events, then enforce on a ring.

Validation: baseline Q1/Q5 over 7 days to capture legitimate VS/Sogou/ClickOnce DLL loads before promoting to IOA. The two GAP rows (reflective .NET load; spear-phish) are not EDR-process-detectable here — cover them via memory-scan/AMSI and email security respectively.