While most organizations rely heavily on Endpoint Detection and Response (EDR) solutions for security, Chinese Advanced Persistent Threat (APT) groups have become masters at exploiting their limitations. These sophisticated actors aren’t just good at what they do – they’re downright crafty. They know that EDRs only see what’s happening on endpoints where they’re installed. Convenient blind spot, isn’t it?

Chinese APTs particularly love targeting devices that lack EDR coverage altogether. Routers, firewalls, VMware systems – they’re all fair game. Groups like UNC3886 deliberately limit their activities to these EDR-free zones. Smart move. No detection tools means no detection. It’s not rocket science.

Chinese APTs excel at hiding where you can’t see them – targeting EDR blind spots with ruthless efficiency.

When they do encounter endpoints with EDR, these threat actors have plenty of tricks up their sleeves. They’re big fans of Living Off the Land techniques, using legitimate system tools already present on machines. PowerShell, wmic, netsh – why bring your own malware when the system provides perfectly good tools? Volt Typhoon is notorious for this approach. Their commands look just like normal admin activities. Good luck spotting the difference.

Zero-day vulnerabilities are another favorite tactic. A staggering 85% of zero-days exploited by Chinese groups since 2021 targeted public-facing appliances. Log4Shell, anyone? They also exploit flaws in security products themselves. Ironic, really – the very tools meant to protect becoming the entry point. Chinese APTs like ToddyCat have successfully leveraged DLL hijacking vulnerabilities to execute malware through otherwise trusted security applications like ESET.

For the technically ambitious, these APTs employ advanced evasion techniques like direct syscalls and module unhooking to bypass EDR hooks. These sophisticated attackers also commonly use code obfuscation techniques to prevent triggering detection systems. Some even patch kernel memory callbacks, making security software think it’s working when it’s actually useless.

And let’s not forget in-memory execution – no disk artifacts, no detection.

The hard truth? EDRs generate so many alerts that security teams suffer from alert fatigue. Meanwhile, Chinese APTs continue exploiting the gaps, moving laterally through networks, and accomplishing their objectives. Right under everyone’s noses.