Brass Typhoon

Brass Typhoon, also known as APT41, Earth Baxia, and Wicked Panda, is a threat actor group originating from China that has been involved in numerous software-supply-chain attacks. This group was formerly identified as Barium, which had carried out more software-supply-chain attacks than any other group globally. Brass Typhoon has recently targeted Taiwanese government agencies, Filipino and Japanese military, and Vietnamese energy companies, installing backdoors for cyberespionage purposes. One of the primary tools utilized by Brass Typhoon is KEYPLUG, a backdoor first disclosed by Google-owned Mandiant. This tool was used in attacks launched by the group to infiltrate six U.S. state government networks between May 2021 and February 2022. The group's activities are characterized by their use of public cloud services for hosting malicious files, enhancing their ability to conduct covert operations. While Brass Typhoon operates independently, there has been some overlap found with other advanced persistent threat (APT) groups. However, the group appears to be distinct, demonstrating unique tactics, techniques, and procedures. Its recent activities signal a significant threat to both governmental and private sectors worldwide, underscoring the importance of robust cybersecurity measures to counter such threats.