Are Security Firms Ducking Attribution for VOHO? (Rhymes with ‘Carolina’)

This report summarizes RSA and related analyses of the VOHO watering‑hole campaign: attackers used xKungFoo scripts and Gh0st‑family trojans in targeted watering‑hole drive‑by compromises that affected tens of thousands of systems across more than 700 organizations (pro‑democracy groups, defense contractors and high‑finance). Researchers observed APT‑style TTPs (targeted user‑profile infections, selected lure sites, C2 infrastructure in the Hong Kong area) and debated possible links to China, but conclusive attribution was not established; the article also highlights expert disagreement over the evidentiary standard for nation‑state attribution.