APT32 Hacker Group Attacking Cybersecurity Professionals Poisoning GitHub

ThreatBook attributes a targeted supply-chain campaign to OceanLotus (APT32) in which a backdoored Cobalt Strike plugin and a malicious Visual Studio project (.suo) were published on GitHub to compromise Chinese cybersecurity professionals; the malware uses DLL hollowing, base64 encoding, and Notion for C2, exfiltrates data/identities, and ThreatBook published IOCs and detection guidance.