Tag: chinese-speaking targets

3 Attack Reports | 0 Vulnerabilities

Attack reports

Digital Doppelgangers: Anatomy of Evolving Impersonation Campaigns Distributing Gh0st RAT

This report details two interconnected malware campaigns targeting Chinese-speaking users in 2025, using large-scale brand impersonation to deliver Gh0st RAT variants. The first campaign, active from February to March, mimicked three brands across over 2,000 domains. The second campaign, starting i…

dll side-loading

brand impersonation

chinese-speaking targets

multi-stage infection

cloud infrastructure

domain generation

Published: November 15, 2025

Downloadable IOCs: 0

NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign

A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads enti…

chinese-speaking targets

memory-resident malware

reflective dll injection

trojanized installers

Published: May 27, 2025

Downloadable IOCs: 31

ValleyRAT Insights: Tactics, Techniques, and Detection Methods

ValleyRAT is a remote access Trojan targeting Chinese-speaking users through phishing campaigns. It employs multi-stage, multi-component tactics to evade detection and maintain persistence. The malware uses various techniques including process injection, registry manipulation, and UAC bypass. It at…

remote access trojan

chinese-speaking targets

Published: October 25, 2024

Downloadable IOCs: 3

Click here to see more Attack Reports