Tag: southeast asia

12 Attack Reports | 0 Vulnerabilities

Attack reports

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

ESET researchers have uncovered a new China-aligned APT group named LongNosedGoblin targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs a varied custom toolset of C#/.NET applications and abuses Group Policy for lateral movement. Key tools include NosyH…
backdoor
apt
china
cyberespionage
cloud services
japan
southeast asia
browser data
group policy
nosydoor
nosydownloader
nosyhistorian
nosylogger
nosystealer
2026-01-03
reversesocks5
Published: January 3, 2026
Downloadable IOCs: 10

Attempts to sniff out governmental affairs in Southeast Asia and Japan

A newly discovered China-aligned APT group named LongNosedGoblin has been targeting governmental entities in Southeast Asia and Japan for cyberespionage purposes. The group employs a varied custom toolset consisting mainly of C#/.NET applications and notably uses Group Policy to deploy malware and …
apt
cyberespionage
custom malware
cloud services
japan
southeast asia
china-aligned
2025-12-19
group policy
nosydoor
nosydownloader
nosyhistorian
nosylogger
nosystealer
Published: December 19, 2025
Downloadable IOCs: 6

Hidden Google Play Adware Drains Devices and Disrupts Millions of Users

A large-scale Android adware campaign dubbed 'GhostAd' has been uncovered, affecting millions of users primarily in East and Southeast Asia. The campaign involved multiple apps on Google Play that appeared harmless but created persistent background advertising engines, draining device resources and…
android
persistence
adware
google play
east asia
southeast asia
2025-11-27
advertising sdks
ghostad
app removal
resource drain
Published: November 27, 2025
Downloadable IOCs: 5

WEBJACK: Evolving IIS Hijacking Campaign Abuses SEO for Fraud and Monetization

A malware campaign called WEBJACK is compromising Microsoft IIS servers to deploy BadIIS malware modules for SEO poisoning and fraud. The attackers hijack high-profile targets, including government and educational institutions, to redirect users to gambling websites. The campaign uses various tools…
seo poisoning
cobalt strike
chinese threat actor
latin america
southeast asia
badiis
iis modules
2025-11-19
xlanyloader
iis hijacking
m0yv
gambling redirection
Published: November 19, 2025
Downloadable IOCs: 34

Operation Dragon Breath (APT-Q-27): Dimensional Reduction Attack Against the Gambling Industry

A threat group known as Golden Eye Dog (APT-Q-27) has been targeting individuals involved in gambling and related activities in Southeast Asia, as well as overseas Chinese communities. The group's operations include remote control, cryptocurrency mining, DDoS attacks, and traffic-related activities…
telegram
watering hole
southeast asia
2025-11-05
miuuti group
ghost
gambling industry
msi installer
golden eye dog
chinese communities
Published: November 5, 2025
Downloadable IOCs: 0

"Sneaky" new Android malware takes over your phone, hiding in fake news and ID apps

A sophisticated Android Trojan has been discovered that masquerades as trusted apps like news readers or digital ID applications. Once installed, it quietly operates in the background, stealing sensitive information such as login credentials and financial data. The malware exploits Android's Access…
android
cryptocurrency
trojan
banking malware
southeast asia
overlay attack
accessibility services
2025-11-05
android/trojan.spy.banker.aur9b9b491bc44
Published: November 5, 2025
Downloadable IOCs: 0

Bookworm to Stately Taurus Using the Attribution Framework

This analysis examines the Bookworm malware family and its connection to the Chinese APT group Stately Taurus. Using a structured attribution framework, the study evaluates tactics, tooling, operational security, infrastructure, victimology and timelines to establish a high-confidence link between …
malware
apt
china
infrastructure
toneshell
pubload
southeast asia
bookworm
2025-09-25
victimology
attribution
Published: September 25, 2025
Downloadable IOCs: 0

Checking all the Boxes: LapDogs, The New ORB in Town

SecurityScorecard's STRIKE team has uncovered a new China-Nexus Operational Relay Box (ORB) network called 'LapDogs', targeting primarily Linux-based SOHO devices globally. The network, active since September 2023, focuses on the United States and Southeast Asia, particularly Japan, South Korea, Ho…
orb
tls certificates
southeast asia
2025-06-26
shortleash
soho devices
CVE-2017-17663
Published: June 26, 2025
Linked vulnerabilities : CVE-2017-17663, CVE-2015-1548
Downloadable IOCs: 26

The new SparkKitty Trojan spy in the App Store and Google Play

A new spyware campaign dubbed SparkKitty has been discovered targeting both iOS and Android devices. The malware, believed to be connected to the previously identified SparkCat campaign, is distributed through official app stores and unofficial sources. It primarily steals photos from infected devi…
ios
android
cryptocurrency
china
spyware
sparkcat
southeast asia
2025-06-23
sparkkitty
Published: June 23, 2025
Downloadable IOCs: 20

Analysis of an incident involving a web shell used as a backdoor

A SOC investigation uncovered a web shell attack on a government SharePoint server in Southeast Asia. The attackers used certutil to download an ASPX payload disguised as a 404 page, then employed Potato tools for privilege escalation. Analysis revealed the web shell to be Behinder, a modular backd…
privilege escalation
badpotato
behinder
godpotato
web shell
southeast asia
2025-02-28
memory-based threats
sweetpotato
potato tools
Published: February 28, 2025
Downloadable IOCs: 0

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 researchers have discovered connections between Stately Taurus, a threat actor targeting ASEAN countries, and the Bookworm malware family. Analysis of infrastructure and code overlaps revealed links between recent Stately Taurus attacks and Bookworm samples dating back to 2015. The group ha…
dll sideloading
toneshell
pubload
modular malware
southeast asia
2025-02-20
asean
infrastructure overlap
bookworm
Published: February 20, 2025
Downloadable IOCs: 0

From South America to Southeast Asia: The Fragile Web of REF7707

While the REF7707 campaign is characterized by a well-engineered, highly capable, novel intrusion set, the campaign owners exhibited poor campaign management and inconsistent evasion practices.
linux
powershell
windows
persistence
siestagraph
certutil
scheduled task
2025-02-12
lolbas
southeast asia
finaldraft
ref7707
guidloader
pathloader
typo squatting
lolbin
remote admin
Published: February 12, 2025
Downloadable IOCs: 40
Click here to see more Attack Reports