Winos4.0 Malware Targets Windows Users Through Malicious PDF Files

FortiGuard Labs reports a January 2025 Winos4.0 campaign targeting organizations in Taiwan via phishing emails that impersonate tax authorities; malicious PDFs and attached ZIPs drop a multi-stage loader (e.g., 20250109.exe/ApowerREC.exe) which decrypts shellcode, performs sandbox detection, stores encrypted modules in the registry, disables UAC and security products, performs clipboard hijacking, keylogging and lateral movement, and contacts C2 infrastructure. The analysis provides IoCs (filenames, registry keys, mutex names, C2 domain), describes anti-forensic and anti-analysis techniques, and recommends controls such as CDR on email gateways, registry monitoring for UAC changes, behavioral detection, and application allowlisting.