Tag: asia

8 Attack Reports | 0 Vulnerabilities

Attack reports

Banners, Bots and Butchers: The AI-Driven Long Con in Asia

This intelligence report details a hybrid cryptocurrency investment scam campaign targeting users in Asia, particularly Japan. The scam combines malvertising techniques to attract victims with pig butchering tactics using AI-powered chatbots for sustained engagement. Victims are lured through socia…
social engineering
malvertising
cryptocurrency
pig butchering
japan
asia
investment scam
domain generation
2026-02-19
ai chatbots
Published: February 19, 2026
Downloadable IOCs: 0

The Shadow Campaigns: Uncovering Global Espionage

This investigation reveals a new cyberespionage group tracked as TGR-STA-1030, believed to be a state-aligned actor operating from Asia. Over the past year, the group has compromised government and critical infrastructure organizations in 37 countries, targeting ministries, law enforcement agencies…
phishing
cobalt strike
government
exploitation
sliver
cyberespionage
godzilla
behinder
sparkrat
infrastructure
havoc
neo-regeorg
asia
vshell
global
CVE-2019-11580
2026-02-05
diaoyu loader
shadowguard
Published: February 5, 2026
Linked vulnerabilities : CVE-2019-11580
Downloadable IOCs: 22

Dissecting UAT-8099: New persistence mechanisms and regional focus

UAT-8099, a threat actor targeting vulnerable IIS servers across Asia, has launched a new campaign from late 2025 to early 2026. The group's tactics have evolved, focusing on Thailand and Vietnam, and employing web shells, PowerShell scripts, and the GotoHTTP tool for remote access. New variants of…
powershell
persistence
vietnam
iis
thailand
badiis
asia
web shells
seo fraud
regional targeting
2026-01-29
gotohttp
Published: January 29, 2026
Downloadable IOCs: 74

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and mili…
espionage
plugx
government
africa
gh0st rat
telecommunications
china chopper
middle east
chinese apt
asia
iis backdoor
2025-09-30
ntospy
specter
iiservercore
assemblyexecuter
net-star
database targeting
Published: September 30, 2025
Downloadable IOCs: 4

GhostContainer backdoor for Exchange servers

A sophisticated backdoor targeting Exchange servers of high-value organizations in Asia has been discovered. The malware, named GhostContainer, is a multi-functional backdoor that can be dynamically extended with additional modules. It leverages several open-source projects and employs various evas…
backdoor
apt
evasion
proxy
open-source
asia
2025-07-17
exchange
ghostcontainer
Published: July 17, 2025
Downloadable IOCs: 1

BERT Ransomware Group Targets Asia and Europe on Multiple Platforms

A newly emerged ransomware group called BERT has been targeting organizations across Asia and Europe since April. The group employs simple code with effective execution, impacting sectors such as healthcare, technology, and event services. BERT's ransomware operates on both Windows and Linux platfo…
linux
ransomware
powershell
windows
encryption
esxi
europe
asia
2025-07-07
bert
Published: July 7, 2025
Downloadable IOCs: 9

Fog Ransomware: Unusual Toolset Used in Recent Attack

A financial institution in Asia was targeted by Fog ransomware in May 2025, using an atypical toolset including legitimate employee monitoring software and open-source pentesting tools. The attackers deployed Syteca, GC2, Adaptix, and Stowaway, which are uncommon in ransomware attacks. They remaine…
espionage
data theft
persistence
lateral movement
CVE-2024-40711
fog ransomware
fog
asia
2025-06-12
unusual toolset
employee monitoring software
financial institution
pentesting tools
2025-06-17
Published: June 17, 2025
Linked vulnerabilities : CVE-2024-40711 (CVSS 9.8)
Downloadable IOCs: 0

Chinese-Speaking Group Manipulates SEO with BadIIS

A Chinese-speaking group is conducting an SEO manipulation campaign in Asia using BadIIS malware. The campaign targets vulnerable Internet Information Services (IIS) servers, compromising them to redirect users to illegal gambling sites or malicious servers. Affected regions include India, Thailand…
malware injection
2025-02-17
seo manipulation
badiis
iis exploitation
asia
gambling websites
Published: February 17, 2025
Downloadable IOCs: 137
Click here to see more Attack Reports