Thai Police Systems Under Fire From 'Yokai' Backdoor

Researchers observed a phishing campaign targeting Thai government-associated individuals that uses malicious LNK shortcuts which leverage NTFS alternate data streams and the legitimate Windows tool esentutl to drop a loader and sideload a new backdoor called "Yokai" via a bundled iTop Data Recovery binary; Yokai establishes encrypted C2 communications, executes shell commands, and exhibits unstable self-replication that can noticeably degrade system performance.