Novel attack on Windows spotted in phishing campaign run from and targeting China

Securonix researchers uncovered a covert phishing campaign called SLOW#TEMPEST targeting Chinese-speaking entities; attackers used zip attachments containing a malicious LNK that executed a renamed LicensingUI.exe to sideload a malicious dui70.dll (Cobalt Strike implant). The intruders deployed multiple post-exploitation tools for scanning, port forwarding, AD enumeration, credential theft, shellcode loading and exfiltration, maintained persistence and lateral movement for over two weeks, and used IPs hosted on Tencent cloud; no firm attribution was established.