TinyNote

TinyNote is a Go-based backdoor developed by Camaro Dragon APT group, associated with Chinese state-sponsored threat actors including Mustang Panda. The malware targets European foreign affairs entities linked to Southeast and East Asia, particularly Myanmar and Indonesia. It features SmadAV antivirus evasion capabilities, uses XOR encryption with the key 'NASA', and employs deceptive folder icons with diplomatic-themed naming conventions. The backdoor focuses on redundancy for persistence, including multiple C&C servers and different command execution methods through PowerShell and Goroutines.