Darktrace Details Twill Typhoon-Linked Campaign Using Updated FDMTP Backdoor
Summary
Darktrace details a campaign observed in customer environments since September 2025 that uses DLL sideloading and a modular .NET backdoor assessed with moderate confidence to align with Twill Typhoon tradecraft.
Key points
- Darktrace observed affected hosts—primarily in the Asia-Pacific and Japan region—contacting domains impersonating Yahoo- and Apple-affiliated services.
- The observed execution sequence involved downloading a legitimate executable, a matching configuration file, and a malicious DLL for sideloading, followed by command-and-control activity.
- The backdoor, identified as an updated FDMTP version 3.2.5.1, uses custom TCP/DMTP communications and supports remote tasking through plugins.
- The malware uses legitimate Windows ClickOnce and Visual Studio hosting processes, in-memory .NET payload loading, and multiple persistence mechanisms, including scheduled tasks and registry entries.
- Darktrace assesses with moderate confidence that the activity aligns with Twill Typhoon tradecraft; initial access was not directly observed.
- The article provides detection guidance, model alerts, MITRE ATT&CK techniques, and indicators of compromise, including file hashes and domains.
Article Details
- Attack Vectors
- Malicious DLL sideloading alongside legitimate executables and matching configuration files.
- Staged payload retrieval from CDN-impersonating infrastructure, followed by C2 registration through /GetCluster.
- Persistence through scheduled tasks, registry entries, and COM hijacking.
- Remote tasking and plugin execution over custom TCP/DMTP communications.
- Defensive Notes
- Monitor for the sequence of legitimate executable, matching configuration file, and DLL retrievals, followed by /GetCluster requests and C2 communication.
- Use behavioral detection anchored to the execution sequence rather than relying only on individual indicators, which Darktrace says may degrade as infrastructure and payloads change.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | www[.]icloud-cdn[.]net | Listed C2/update domain contacted to retrieve a version string and encrypted payload. |
| DOMAIN | www[.]yahoo-cdn[.]it[.]com | Listed payload-delivery domain used to serve executables, configuration files, and DLLs. |
| MD5 | 067fbad4d6905d6e13fdc19964c1ea52 | Hash listed for the Persist.Registry persistence plugin. |
| MD5 | 162f69fe29eb7de12b684e979a446131 | Hash listed for the Persist.Extra persistence plugin. |
| MD5 | 2cd781ab63a00ce5302ed844cfbecc27 | Hash listed for the Assist remote-access plugin. |
| MD5 | 482cc72e01dfa54f30efe4fefde5422d | Hash listed for the Client.DmtpFrame.dll malware component. |
| MD5 | b2c8f1402d336963478f4c5bc36c961a | Hash listed for the malicious dnscfg.dll payload. |
| MD5 | c17f39d25def01d5c87615388925f45a | Hash listed for the malicious browser_host.dll used for DLL sideloading. |
| MD5 | c650a624455c5222906b60aac7e57d48 | Hash listed for the maliciously used Visual Studio hosting process DLL component. |
| MD5 | df3437c88866c060b00468055e6fa146 | Hash listed for the Persist.WpTask scheduled-task plugin. |
| MD5 | fc3959ebd35286a82c662dc81ca658cb | Hash listed for the test.zip malware archive. |
MITRE ATT&CK
T1027.007 · Dynamic API ResolutionThe payload resolves strings and loads mscoree.dll dynamically at runtime.T1030 · Data Transfer Size LimitsThe implant collects administrator status and user information.T1053.005 · Scheduled TaskThe malware adds a scheduled task for %APPDATA%\Local\Microsoft\WindowsApps\dfsvc.exe.T1071.001 · Web ProtocolsThe observed staging and C2 registration activity uses HTTP GET requests.T1082 · System Information DiscoveryThe implant collects system-profile information, including operating system, hardware, and CLR version.T1095 · Non-Application Layer ProtocolThe backdoor communicates with C2 over custom TCP using DMTP.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypts embedded strings and AES-encrypted payloads before loading or using them.T1546.016 · Installer PackagesA custom AppDomainManager and a COM object registered under HKCU\Software\Classes\TypeLib are used to execute and persist the DLL.T1574.001 · DLLA malicious DLL with the same name as a legitimate DLL is loaded by biz_render.exe to hijack execution.T1620 · Reflective Code LoadingThe decrypted .NET assembly is loaded directly from memory using Assembly.Load(byte[]).
People
Threat Actors
Malware
Products
.NETalongside malicious Dynamic Link Libraries (DLLs), enabling sideloading and execution of a modular .NET-based Remote Access Trojan (RAT) framework.Microsoft WindowsThe DLL uses the Windows Common Language Runtime (CLR) to execute managed .NET code inside the process rather than relying solely on native binaries. During execution, the loader loads a payload directly into memory asSogou Pinyin IMEA legitimate executable: biz_render.exe (Sogou Pinyin IME)Visual Studioand DLL components (including dfsvc.exe.config and dnscfg.dll) over an 11-day window. The use of both Visual Studio hosting and OneClick (dfsvc.exe) paths are used to ensure the malware can run in the targeted