Moon_WALK
Moon_WALK is a threat actor group, tracked by Brandefense. It targets the Manufacturing, and Retail and Consumer sectors. It uses 1 MITRE ATT&CK technique.
- CurveLast
- SneakCross
- Techniques
- 1
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
About Moon_WALK.
APT41, a China-based nation-state threat actor known for campaigns in Southeast Asia, has been observed using a new backdoor called MoonWalk. MoonWalk shares a common development toolkit with 'DUSTTRAP', reusing code that implements evasive techniques such as DLL hollowing, import resolution, DLL unhooking, and call stack spoofing. Additionally, MoonWalk employs further evasion tactics, including the use of Google Drive as its C2 channel to blend in with legitimate network traffic and the utilization of Windows Fibers to evade AV/EDR security solutions. MoonWalk's modular design allows attackers to easily update its capabilities, modify its behavior, and customize functionality for different scenarios.
Last updated Sep 14, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.