The threat actor is conducting a spearphishing campaign to deliver malicious attachments, maintain persistence, and establish command and control.
Tag: T1218.005
Hunt 4 DLL sideload by China
The threat actor may attempt to execute malicious code by side-loading a malicious DLL using a legitimate application.
Lazarus Lure in Yacht club
The Lazarus group is conducting a spearphishing campaign targeting individuals involved in the maritime industry, particularly yacht and luxury vessel sales, using malicious attachments to deliver malware.
Game of Emperor
The threat actor has gained initial access and is utilizing various defense evasion techniques to avoid detection while establishing persistence and maintaining control.
Volt Typhoon against energy etc.
Attackers may be using Mshta.exe or Rundll32.exe to execute malicious code.
Clearing Fog of War
A malicious actor might be leveraging MSHTA for defense evasion and utilizing various techniques for OS credential dumping within the environment.