Loading story…
Japanese security researchers reported that menuPass (APT10) targeted multiple organizations in Japan with new spearphishing campaigns that delivered Cobalt Strike Beacon in memory, marking the first observed case of the group using the framework. One infection chain used an encrypted executable attachment that unpacked a loader DLL and AES-encrypted shellcode; another used a macro-enabled document inside an encrypted ZIP archive to download staged scripts and shellcode disguised as a bitmap file. The malware ultimately beaconed to attacker-controlled infrastructure, including 95.128.168[.]227, while attempting to blend into normal web traffic.
The activity aligns with broader reporting on Asian intrusion campaigns in which advanced threat actors relied on Cobalt Strike and stealthy post-compromise tradecraft to maintain access inside enterprise networks. In the Japan-focused campaign, operators spoofed Host headers for en.wikipedia.org and used a self-signed certificate containing "wikipedia" fields to mask command-and-control traffic, underscoring a shift toward more covert tooling and infrastructure designed to evade detection during targeted espionage operations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
LAC reported that the menuPass (APT10) threat group conducted new spearphishing attacks against multiple Japanese organizations beginning in late April and early May 2018. The campaign used at least two infection chains and marked the first observed case of this actor abusing Cobalt Strike.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and U.S. authorities reported multiple spearphishing campaigns linked with moderate confidence to **APT29/Nobelium/Cozy Bear** that targeted government agencies, NGOs, research institutions, embassies, and other high-value organizations. In one campaign, emails impersonating **USAID** used **Constant Contact** links to deliver malicious ISO files containing a decoy PDF, a weaponized **`.lnk`** shortcut, and a DLL loader that launched **Cobalt Strike Beacon** through `rundll32.exe`; CISA said the beacon used HTTP traffic disguised as requests for **`.woff2`** files and embedded metadata in a `_cfuid` cookie while contacting infrastructure including **theyardservice.com** subdomains and **worldhomeoutlet.com**. Volexity also identified a second-stage malware family, **FRESHFIRE**, which retrieved encrypted payloads from Firebase and decrypted them with host-specific logic before deleting the remote content. The activity fit a broader pattern seen in earlier and later operations attributed to the same cluster. FireEye documented a separate campaign in which attackers impersonated the **U.S. Department of State**, delivered ZIP archives with malicious shortcuts, used PowerShell to drop a decoy document, and installed Cobalt Strike Beacon communicating with **pandorasong.com** via a modified malleable C2 profile. Fortinet later described embassy-focused phishing that used **HTML smuggling** to build an ISO on the victim system, then relied on shortcut-triggered DLL execution to deploy another beacon, showing continued reuse of ISO-based delivery, decoy documents, and staged loaders across politically themed intrusion attempts.
Aug 15, 2026
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026