BadAudio Malware Exposed in APT24 Espionage Campaign

BadAudio malware came to light after researchers uncovered a long-running espionage operation by the China-linked group APT24. The actor targeted Windows systems across multiple sectors and used a mix of watering-hole attacks, spear-phishing and supply-chain compromises to deliver its payload. The campaign expanded steadily over three years and highlighted how advanced threat actors now blend several infection routes to improve success rates.

How APT24 Delivered the Malware

APT24 relied on a diverse set of delivery methods. The group compromised more than twenty public websites and injected malicious JavaScript that profiled visitors and displayed fake update prompts to selected targets. The sites appeared legitimate, so victims often trusted the prompts and installed BadAudio malware without suspicion.
The actor also breached a digital-marketing provider that supplied JavaScript libraries to more than one thousand domains. This breach created a supply-chain infection path that pushed malicious scripts to many unrelated websites. These scripts helped BadAudio malware spread quietly across high-value networks.
Spear-phishing added another layer. The group used themed emails that contained tracking pixels to confirm whether a target opened the message. The emails linked to cloud-hosted files posing as documents or updates. Once opened, the files delivered the first stage of BadAudio malware.

How BadAudio Malware Works

BadAudio malware uses loader techniques that complicate analysis. It relies on DLL search-order hijacking to run malicious code while appearing legitimate. The loader includes heavy code obfuscation that forces analysts to map each execution path manually.
After launch, the malware collects basic system information and encrypts the data using a hard-coded key. It then contacts a command server and downloads an additional payload. The malware decrypts this payload in memory and loads it through DLL sideloading, which helps it avoid many detection engines. Researchers even observed Cobalt Strike Beacon activity in at least one infection chain.

Why Detection Remained Low

BadAudio malware maintained a low detection rate throughout the campaign. Several samples triggered only a handful of antivirus alerts. The combination of obfuscation, sideloading and diverse delivery methods allowed APT24 to sustain long-term access to compromised systems. The low visibility also delayed discovery and created opportunities for intelligence gathering.

Conclusion

BadAudio malware demonstrates how advanced threat actors now combine multiple attack routes to maintain persistence. APT24 executed a multi-year campaign that blended supply-chain breaches, spear-phishing and watering-hole attacks. Organisations must strengthen monitoring, validate third-party code and watch for unusual DLL behaviour. The exposure of BadAudio malware shows how quickly espionage operations can escalate when detection gaps remain unaddressed.