Researchers have uncovered a sophisticated attack targeting Chinese-speaking users, utilizing phishing emails to deploy Cobalt Strike payloads on Windows systems.
With attackers remaining undetected for over two weeks, they successfully moved laterally and established persistence within compromised systems.
The covert campaign SLOW#TEMPEST initiates with malicious ZIP files containing an LNK file disguised as a Microsoft Word document, indicating potential targeting of specific Chinese sectors.
By using DLL side-loading via LicensingUI.exe, which is reported for the first time, the attackers gain persistent access to infected hosts for further exploitation.
[
Collection
]
[
|
...
]