Loading threat actor…
SLOW#TEMPEST is a malware threat cluster tracked for campaigns targeting Chinese-speaking users. The group has been observed using DLL sideloading to execute malicious payloads through loader components designed to evade analysis and detection. Reported tradecraft includes Control Flow Graph obfuscation, dynamic function resolution, and other anti-analysis measures intended to conceal loader logic and hinder reverse engineering. Associated payloads have included Cobalt Strike and Mimikatz, indicating post-compromise capability for credential access and broader hands-on-keyboard intrusion activity. Based on the available high-confidence reporting, SLOW#TEMPEST is best characterized as an intrusion set distinguished by stealthy malware loading and defense-evasion techniques rather than a fully attributed nation-state or ransomware actor. No corroborated country-of-origin, industry specialization, or extortion activity is established from the available facts.
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
2 malware families Mallory has associated with this actor across public reporting.
22 indicators attributed to this actor. Values are masked here and available in full in Mallory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.