The attackers moved laterally across the organization's network, compromising multiple computers. Some of the machines targeted were Exchange Servers, suggesting the attackers were gathering intelligence by harvesting emails.
Links to China as the potential culprit stem from the use of DLL side-loading, a preferred tactic among various Chinese threat groups, alongside artifacts tied to the state-sponsored operation codenamed Crimson Palace.
Collection
[
|
...
]