MoonWalk | ThreatLabz

Zscaler ThreatLabz provides a technical deep-dive into MoonWalk, a modular C backdoor linked to APT41 that reuses DodgeBox tooling; the report describes in-memory loading, DLL hollowing, Windows Fiber-based execution to evade AV/EDR, a custom AES/ECDH-based handshake and encrypted C2 using Google Drive, plugin structure and configuration details, and supplies IOCs (file hashes, OAuth tokens, Drive endpoints) and MITRE ATT&CK mappings to aid detection and response.