Introduction
(Securonix) The Securonix Threat Research team has uncovered a covert campaign targeting Chinese-speaking users with Cobalt Strike payloads likely delivered through phishing emails. The attackers managed to move laterally, establish persistence and remain undetected within the systems for more than two weeks.
Activities and Tactics
Country of Origin: 🇨🇳 [“China”]
Notable Campaigns
Information pending cataloguing.
Tactics, Techniques, and Procedures (TTPs)
Information pending cataloguing.
Notable Indicators of Compromise (IOCs)
No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.
Malware and Tools
- Cobalt Strike
- Mimikatz
- Cobalt Strike:
- Mimikatz:
Attribution and Evidence
Country of Origin: [“China”] Additional attribution information pending cataloguing.
References
References pending cataloguing.