Loading story…
Secureworks reported that the TIN WOODLAWN cyberespionage group used a modified version of Cobalt Strike in targeted intrusions designed to evade standard security detections. The activity was attributed to a threat group likely operated or tasked by the Vietnamese government, with operations focused on stealing intellectual property and trade secrets as well as targeting journalists and political opponents of interest to Vietnam.
In the observed attacks, the group used spearphishing attachments consistent with MITRE ATT&CK technique T1598.002 to deliver malicious documents, then relied on macro code to create scheduled tasks and abused mshta to fetch an in-memory PowerShell Beacon stager. Secureworks said the actors also deployed a custom stager, CommaChameleon, which used the unusual PowerShell -comma switch with randomized casing, received an RC4-encrypted payload through a named pipe, and injected it into legitimate Windows processes such as esentutl.exe, underscoring a layered evasion approach associated with a sophisticated state-backed actor.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
Secureworks CTU reported that TIN WOODLAWN used a custom stager it named CommaChameleon, which leveraged the shortened PowerShell '-comma' switch with randomized casing, received an RC4-encrypted payload through a named pipe, and injected it into legitimate Windows processes. In one campaign, the injected payload included Mimikatz for credential theft via esentutl.exe.
Secureworks CTU assessed that TIN WOODLAWN is likely operated or tasked by the Vietnamese government. The group was described as conducting espionage to steal intellectual property and trade secrets and targeting journalists and political opponents of interest to Vietnam.
Secureworks incident responders observed the TIN WOODLAWN cyberespionage group using a modified version of Cobalt Strike during targeted intrusions to evade detections based on default configurations. The activity included spearphishing-delivered malicious documents, scheduled tasks, mshta abuse, in-memory PowerShell Beacon staging, and use of the custom CommaChameleon stager.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers documented targeted intrusion campaigns that used military and geopolitical decoy documents to compromise victims in South Asia and deploy **Cobalt Strike**. Cisco Talos reported that attackers distributed malicious Microsoft Office files posing as Indian Air Force and other government or military documents, with macros dropping a custom loader called **IndigoDrop** into the Windows Startup folder for persistence. IndigoDrop performed anti-infection checks, fetched Metasploit shellcode, and ultimately loaded an XOR-encoded Cobalt Strike beacon hidden in trojanized jQuery files, while related Python modules conducted reconnaissance and stole browser and Wi-Fi credentials. A separate campaign analyzed by Zscaler used a Word document themed around the India-China border dispute to trigger a macro-delivered PowerShell chain that staged shellcode behind a fake GIF header and installed a Cobalt Strike beacon over HTTPS. The operators used fileless techniques, spoofed HTTP `Host` headers such as `update.windows.microsoft.com`, and in some variants injected an RSA-encrypted payload into `notepad.exe`; researchers also identified infrastructure including `47.240.73.77`, `114.67.110.37`, and `360doc.com`-based command-and-control domains. Across both campaigns, the attackers relied on topical military lures, multi-stage loaders, and legitimate-looking web traffic to conceal remote access activity against likely government and defense-related targets.
Aug 15, 2026
Researchers linked multiple malware families to **OceanLotus**/**APT32** activity, showing the group used evolving backdoors and loaders in targeted intrusions against organizations in Vietnam and the automotive sector. Earlier analysis described **JEShell**, a Java-based second-stage backdoor deployed alongside **KerrDown**, with both malware families decoding layered shellcode to install or download a **Cobalt Strike Beacon** implant and, in some cases, sharing command-and-control infrastructure for redundancy. JEShell used an XOR-encrypted resource to unpack shellcode and inject it either into the current Java process on 32-bit systems or into a hardcoded `SysWOW64` process on 64-bit hosts. Later reporting tied a newer intrusion set to the same actor with moderate confidence, identifying a coordinated toolchain built around the **SPECTRALVIPER** backdoor, **P8LOADER**, and the **POWERSEAL** PowerShell runner. In observed attacks, a malicious DLL was dropped over SMB and launched through a renamed ProcDump binary, after which DONUTLOADER injected into `sessionmsg.exe` to deploy SPECTRALVIPER and then conditionally execute P8LOADER or POWERSEAL. SPECTRALVIPER supported HTTP and named-pipe C2, PE loading and injection, token impersonation, file transfer, and file-system manipulation, while POWERSEAL included AMSI and ETW bypasses; identified victims included large public companies in Vietnam, including agribusiness and financial services firms.
Aug 14, 2026
A spearphishing campaign attributed with high confidence to **Tropic Trooper** targeted employees at Chinese companies with a housing fund-themed lure that delivered a ZIP archive containing a disguised `.lnk` shortcut, a decoy Excel file, a hidden `&Recycle.Bin` folder, a legitimate McAfee-signed executable, a malicious DLL, and an encrypted payload. When the shortcut was opened, the malware chain launched the signed executable through **DLL side-loading**, displayed the decoy document, copied files into `C:\Users\Public\Downloads`, renamed `NTUSER.EXE` to `AVIRA.EXE`, and decrypted `setting.dat` to reflectively load a **Cobalt Strike Beacon** into memory.
Aug 15, 2026