GroundPeony: Crawling with Malice

This report analyzes GroundPeony (aka UNC3347), a China‑nexus APT active since at least 2021, which targeted Taiwanese and Nepalese government organizations via spear‑phishing and compromised websites using obfuscated URLs, multi‑stage loaders (mic.exe/version.dll), DLL sideloading, and a custom downloader (“micDown”) to retrieve shellcode/Cobalt Strike from C2 such as app.onedrivo.com and 103.199.17.184. It highlights the group’s early exploitation of CVE‑2022‑30190 (Follina) as a zero‑day, traces related campaigns, and provides actionable IoCs, infrastructure details, and TTPs to aid SOC/IR defenses.