Tag: southeast asia

3 Attack Reports | 0 Vulnerabilities

Attack reports

Analysis of an incident involving a web shell used as a backdoor

A SOC investigation uncovered a web shell attack on a government SharePoint server in Southeast Asia. The attackers used certutil to download an ASPX payload disguised as a 404 page, then employed Potato tools for privilege escalation. Analysis revealed the web shell to be Behinder, a modular backd…

privilege escalation

memory-based threats

Published: February 28, 2025

Downloadable IOCs: 0

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 researchers have discovered connections between Stately Taurus, a threat actor targeting ASEAN countries, and the Bookworm malware family. Analysis of infrastructure and code overlaps revealed links between recent Stately Taurus attacks and Bookworm samples dating back to 2015. The group ha…

dll sideloading

modular malware

infrastructure overlap

Published: February 20, 2025

Downloadable IOCs: 0

From South America to Southeast Asia: The Fragile Web of REF7707

While the REF7707 campaign is characterized by a well-engineered, highly capable, novel intrusion set, the campaign owners exhibited poor campaign management and inconsistent evasion practices.

Published: February 12, 2025

Downloadable IOCs: 40

Click here to see more Attack Reports