WINOS 4.0 HACKERS EXPAND TO JAPAN AND MALAYSIA WITH NEW MALWARE

Summary from the TLDR InfoSec newsletter

Winos 4.0 threat actors have expanded operations from China and Taiwan to Japan and Malaysia, deploying HoldingHands RAT through phishing emails with fake Finance Ministry PDFs containing embedded malicious links hosted primarily on Tencent Cloud infrastructure. The sophisticated multi-stage attack chain uses digitally signed executables, anti-VM checks, targets Norton/Avast/Kaspersky for evasion, leverages Windows Task Scheduler for persistence, and injects payloads into taskhostw.exe with process monitoring for re-injection, while newer variants added C2 IP update capabilities via registry (HKEY_CURRENT_USER\SOFTWARE\HHClient). Security teams should monitor for suspicious PDF attachments impersonating government finance documents, block identified C2 infrastructure, including IP 156.251.17[.]9 and domain twczb[.]com, implement behavioral detection for Task Scheduler manipulation and unusual dokan2.dll/TimeBrokerClient.dll activity in System32, and trace Tencent Cloud APPID patterns to identify related phishing infrastructure.