Loading story…
A sophisticated phishing campaign has been identified targeting users across multiple Asian countries, including China, Taiwan, Japan, and Malaysia. The campaign initially surfaced in January 2025, when Fortinet researchers observed attacks in Taiwan utilizing the Winos 4.0 malware. By February, the threat actor had shifted tactics, deploying new malware families such as the HoldingHands Trojan and expanding operations to additional countries in the region. The attackers primarily targeted Microsoft Windows users, leveraging phishing emails that contained PDF attachments masquerading as official documents from ministries of finance and other government agencies. These malicious PDFs included multiple embedded links, most of which were hosted on Tencent Cloud storage. Unique account IDs embedded in the URLs allowed analysts to attribute various malicious files to the same threat actor, revealing a coordinated and expansive campaign. The phishing documents evolved over time, with some later versions imitating government purchase orders and tax regulation drafts to increase their credibility and lure victims. The campaign’s primary focus appeared to be Chinese-speaking individuals, as evidenced by the prevalence of Chinese-named malware variants found on VirusTotal. The attackers employed advanced obfuscation techniques to evade detection and maintain persistence within targeted environments. The stolen information from these attacks is believed to be used for future operations, indicating a likely motivation of regional intelligence collection. The malware deployed in these campaigns often remained dormant after infection, awaiting further commands from the attackers. Researchers highlighted the strategic connections between seemingly unrelated attacks by analyzing shared infrastructure, code patterns, and operational tactics. The use of Tencent Cloud for hosting malicious payloads provided the attackers with scalability and a degree of anonymity. The campaign’s expansion from China to Taiwan, then Japan, and most recently Malaysia, demonstrates the threat actor’s adaptability and intent to broaden their reach. Security analysts recommend heightened vigilance for phishing emails, especially those purporting to be from government agencies, and advise organizations to monitor for suspicious activity related to Tencent Cloud links. The campaign underscores the ongoing threat posed by well-resourced actors conducting cross-border cyber operations in Asia. Organizations are urged to update their threat models and incident response plans to account for these evolving tactics. The high severity of the campaign is attributed to its broad geographic scope, advanced techniques, and potential for significant intelligence compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
On October 18, 2025, follow-on reporting associated the campaign with the Chinese threat group Silver Fox and emphasized its expansion from China and Taiwan into Japan and Malaysia using HoldingHands RAT and Winos 4.0-related tooling.
On October 17, 2025, FortiGuard Labs publicly tied the Taiwan, China, Japan, and Malaysia phishing clusters to a single actor using shared domains, IPs, scripts, debug paths, signed droppers, and Tencent Cloud account artifacts, and released associated indicators of compromise and detections.
Researchers identified an updated HoldingHands payload that can change its command-and-control server IP through a Windows registry value, allowing the operator to rotate infrastructure without redeploying the malware.
In the latest Malaysia-linked activity, the actor introduced a more evasive infection chain using DLL side-loading, Windows Task Scheduler restart behavior, in-memory decryption, anti-VM checks, and privilege-escalation techniques to reduce forensic visibility and evade defenses.
As the campaign expanded regionally, the actor began delivering the HoldingHands remote access trojan through phishing emails and cloud-hosted links, using shared infrastructure, Tencent Cloud-hosted content, and overlapping obfuscation methods to support intrusions across multiple countries.
By February 2025, the campaign had evolved from Winos 4.0 activity in Taiwan to broader operations across Asia, with the actor shifting to additional malware families and extending targeting into China, Japan, and Malaysia.
In early 2025, the threat actor launched phishing activity targeting Taiwan, using lures themed as government and business documents to deliver the Winos 4.0 malware family on Windows systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcefeeds.fortinet.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026
Proofpoint reported that suspected China-linked cybercrime group **TA4922** has expanded beyond its traditional East Asia focus and is now targeting organizations in the **UK, Germany, Italy, South Africa**, and other regions with localized phishing campaigns. The actor has used lures tied to **tax filings, payroll, benefits, invoices, HR notices, and compliance requests** to trick recipients into opening attachments, clicking links, or continuing email conversations, with activity increasing from spring 2025 and intensifying in March and April 2026. The campaigns delivered credential phishing and malware including **`SilentRunLoader`**, **`Atlas RAT`**, **`RomulusLoader`**, and **`Winos4.0`/`ValleyRAT`**. Proofpoint said the group relies on **DLL sideloading**, anti-analysis techniques, process injection, and selective payload delivery, while also abusing legitimate remote-management and file-sharing tools such as **AnyDesk**, **SyncFuture**, **GoFile**, **LimeWire**, and **MediaFire** to blend into normal activity and maintain access. Researchers assessed the actor as primarily **financially motivated**, pursuing credential theft, fraud, data theft, persistence, and access resale, and said code artifacts in the Python-based **`SilentRunLoader`** suggest some malware development may have been assisted by **large language models**.
Aug 11, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026