Phishing Campaign Uses Maduro Arrest Story to Deliver Backdoor Malware

The report details a geopolitical-themed spear-phishing campaign using a zip attachment (“US now deciding what’s next for Venezuela.zip”) that contains a weaponized KuGou executable and a malicious kugou.dll which is loaded via DLL hijacking to install a backdoor; the malware creates C:\ProgramData\Technology360NB, persists via HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Lite360, prompts a restart to trigger the payload, and regularly connects to C2 at 172.81.60.97:443. IoCs (IP and file hashes) are provided and researchers note similarities to prior Mustang Panda activity but do not attribute definitively.