Fangao

Fangao is a sophisticated multi-stage loader malware associated with the SalmonSlalom threat group, targeting industrial organizations in the Asia-Pacific region. It uses complex delivery mechanisms including DLL side-loading, leverages Chinese CDN services (myqcloud) and Youdao Cloud Notes for payload storage, and employs publicly available packers for encryption. The loader is designed to bypass security solutions through dynamic C2 server changes and legitimate application functionality abuse.