Operation HollowQuill – Weaponized PDFs Deliver a Cobalt Strike Malware Into Gov & Military Networks

SEQRITE Labs uncovered 'Operation HollowQuill', a sophisticated cyber‑espionage campaign targeting Russian academic, government, and defense networks. Attackers distribute a malicious RAR containing a .NET dropper, a Go-based shellcode loader, a legitimate OneDrive binary used for process injection, and a decoy PDF; the payloads execute in memory (APC injection) and deploy Cobalt Strike beacons communicating with rotating C2 domains such as phpsymfony.com, while artifacts reveal anti-analysis techniques and exposed build identifiers.