(Trend Micro) In early April, we discovered that a new threat actor group (which we call Void Arachne) was targeting Chinese-speaking users. Void Arachne’s campaign involves the use of malicious MSI files that contain legitimate software installer files for artificial intelligence (AI) software as well as other popular software. The malicious Winos payloads are bundled alongside nudifiers and deepfake pornography-generating AI software, voice-and-face-swapping AI software, zh-CN (Simplified Chinese) language packs, the simplified Chinese version of Google Chrome, and Chinese-marketed virtual private networks (VPNs), such as LetsVPN and QuickVPN. During the process of installation, a Winos backdoor is also installed, which could also lead to full system compromise.
A sophisticated malware campaign, linked to the Chinese threat actor group Silver Fox (aka Yinhu), is using fake software download websites to distribute malicious installers. These installers deploy malware that weakens…
The threat actor Silver Fox is distributing the ValleyRAT backdoor disguised as a signed Chinese adware application (QN Wallpaper) to bypass antivirus protections. This sophisticated malware, tracked as Winos 4.0, allows…
This report details a sophisticated campaign utilizing adware to distribute the ValleyRAT backdoor. Attackers leveraged a legitimate adware application, signed by a developer, to bypass security measures and install the…
A new campaign targeting Cambodia is utilizing a sophisticated multi-stage attack leveraging a vulnerable OPSWAT driver to deploy the open-source remote access trojan, Spark RAT. Attackers are using deceptive phishing em…
The Chinese cybercrime group Silver Fox is targeting Japanese manufacturers using a sophisticated Bring Your Own Vulnerable Driver (BYOVD) attack chain to deploy ValleyRAT, a Gh0st RAT variant. They utilize a layered app…
The China-linked cybercrime group behind tax-themed phishing campaigns is utilizing a sophisticated crypter service called Cruciferra to deliver a wide range of malware, including remote access trojans and information st…
A Chinese cybercrime group, known as CylindricalCanine (a sub-group of GoldenEyeDog), has been linked to a significant security breach at DigiCert, a code-signing certificate provider. The attackers exploited a vulnerabi…
A China-linked cybercrime group, Silver Fox, is using a new Rust-based remote access trojan called MODBEACON to target technology, education, and state-owned enterprises in Asia. The trojan utilizes gRPC streaming for en…
A China-nexus threat actor is conducting a targeted phishing campaign against Indian taxpayers and tax professionals, leveraging fake tax filing utilities to deploy a remote access trojan (DcRAT). The campaign, dubbed Op…
China's TA4922 cybercrime group has significantly expanded its operations globally, targeting a diverse range of countries and employing a wider array of tactics and techniques than previously observed. Initially focused…
A China-linked cybercrime group, TA4922, has broadened its phishing attacks to include organizations in the UK, Germany, Italy, and South Africa. The group utilizes a constantly evolving arsenal of malware, including Val…
A Chinese cybercrime group, TA4922, is experiencing a record surge in campaign activity, utilizing sophisticated social engineering tactics to target organizations globally. The group’s primary objectives involve data th…
