Unmasking the new persistent attacks on Japan

Cisco Talos documents an active campaign (since Jan 2025) targeting organizations in Japan that leverages CVE-2024-4577 (PHP-CGI RCE) to execute PowerShell downloaders that inject Cobalt Strike reverse HTTP beacons; operators then use TaoWu Cobalt Strike plugins and public tools (JuicyPotato/SweetPotato/RottenPotato, Ladon, SharpTask, SharpGPOAbuse, fscan, Seatbelt, Mimikatz) to escalate privileges, establish persistence, perform lateral movement, and exfiltrate credentials, while hosting C2 and preconfigured attack tooling on Alibaba cloud with exposed repositories and published IOCs.