Operation PZCHAO
summary
Malware campaign active since July 2017 targets Asia and infects a telemetry-observed 10,000 institutions across government, telecom, education and tech using a staged dropper: self‑extracting 7zip, batch scripts that kill AV and install a scheduled task masquerading as an Adobe updater, a mimikatz credential dumper for password harvesting, Bitcoin miners, and a modified Ghost RAT backdoor DLL that decrypts AES C2 addresses, performs handshake, exfiltrates data weekly at 3 a.m., and shows clear infrastructure reuse and campaign resets.
AI-written summary · about
chapters (6)
related talks
33mOperation GamblingPuppet: Analysis of a Multivector and Multiplatform Campaign Targeting Online ...
55mRevealing the Attack Operations Targeting Japan
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
42mWho Let the Dogs Out? When PUPs Become BlackCat's Best Friend
49mThe State Of Malware From The Eye Of The Tiger
55mNation-State Moneymule's Hunting Season – APT Attacks Targeting Financial Institutions
10mSurfacing from the Underbrush: Machete Pivots to Intrusion-Enabled Info Ops
47mDetecting and analyzing files-less malware