Operation SalmonSlalom: New Malware Campaign Targets Industrial Organizations in Asia-Pacific

Kaspersky ICS CERT details "Operation SalmonSlalom," a sophisticated, multi-stage campaign targeting industrial organizations across the Asia–Pacific that delivers the FatalRAT remote-access trojan via phishing (email, WeChat, Telegram). Attackers use packed first-stage loaders, retrieve dynamic payload URLs from Youdao Cloud Notes, leverage legitimate Chinese cloud/CDN services and DLL sideloading (abusing PureCodec) for persistence and evasion, and focus on sectors such as manufacturing, energy, healthcare, and logistics across multiple APAC countries.