Sophisticated Attacks Employ Cobalt Strike, DLL Sideloading, and Evolving Tactics

*Sophos researchers exposed a late‑2023 to early‑2024 targeted campaign that delivered Cobalt Strike via DLL sideloading, abused expired/compromised certificates, used Minhook for API hooking, and hid payloads in resources and memory; initial detections were in China and Taiwan with subsequent telemetry pointing to Sweden, and the report lists C2 domains and deceptive URIs while urging monitoring of unexpected DLL loads and hooked APIs.*