{"id":56993,"date":"2024-09-02T03:06:24","date_gmt":"2024-09-02T03:06:24","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/novel-attack-on-windows-spotted-in-phishing-campaign-run-from-and-targeting-china\/"},"modified":"2024-09-02T03:06:24","modified_gmt":"2024-09-02T03:06:24","slug":"novel-attack-on-windows-spotted-in-phishing-campaign-run-from-and-targeting-china","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/novel-attack-on-windows-spotted-in-phishing-campaign-run-from-and-targeting-china\/","title":{"rendered":"Novel attack on Windows spotted in phishing campaign run from and targeting China"},"content":{"rendered":"

Chinese web champ Tencent’s cloud is being used by unknown attackers as part of a phishing campaign that aims to achieve persistent network access at Chinese entities.<\/p>\n

US-based threat detection, investigation and response tools vendor Securonix last week claimed<\/a> to have “uncovered a covert campaign targeting Chinese-speaking users with Cobalt Strike payloads likely delivered through phishing emails. The attackers managed to move laterally, establish persistence and remain undetected within the systems for more than two weeks.”<\/p>\n

Securonix threat researchers Den Iuzvyk and Tim Peck wrote that they could not determine the origin of the attack, nor the attack vector. But the pair were able to conclude that it starts with phishing mails that carry compressed Zip files titled “20240739\u4eba\u5458\u540d\u5355\u4fe1\u606f.zip” \u2013 which translates to “Personnel list information.”<\/p>\n