Operation Jacana: Foundling hobbits in Guyana

ESET details Operation Jacana, a targeted spearphishing campaign against a Guyanese government entity that delivered a novel C++ backdoor dubbed DinodasRAT (TEA-encrypted communications and screenshot/clipboard exfiltration) alongside a Korplug/PlugX variant; the report includes behavior analysis, supported commands, lateral movement and credential-dumping activity, IoCs (hashes, IPs, domains), and MITRE ATT&CK mappings, with medium confidence attribution to a China-aligned actor.