Tag: govershell

2 Attack Reports | 0 Vulnerabilities

Attack reports

Tall Tales: How Chinese Actors Use Impersonation and Stolen Narratives to Perpetuate Digital Transnational Repression

In collaboration with the International Consortium of Investigative Journalists (ICIJ), two distinct actor clusters aligned with the People's Republic of China were identified targeting journalists and civil society members. GLITTER CARP conducted widespread credential harvesting campaigns against …
credential harvesting
digital transnational repression
healthkick
govershell
2026-04-28
chinese contractors
glitter carp
impersonation campaigns
journalist targeting
oauth phishing
sequin carp
tibetan activists
uyghur targeting
Published: April 28, 2026
Downloadable IOCs: 6

APT Meets GPT: Targeted Operations with Untamed LLMs

Over the course of three months, Volexity observed UTA0388 using various themes and fictional identities across dozens of spear phishing campaigns. As time passed, Volexity observed UTA0388 broaden their targeting and send emails in a variety of different languages, including English, Chinese, Japa…
phishing
powershell
persistence
zip
websocket
rar
2025-10-08
uta0388
govershell
llms
randomdir8char
govershell c2
archive file
Published: October 8, 2025
Downloadable IOCs: 41
Click here to see more Attack Reports