Hackers increasingly use Winos4.0 post-exploitation kit in attacks

The report documents the Winos4.0 post-exploitation framework being distributed through seemingly legitimate game-related installers targeting Chinese users; the malware uses multi-stage DLL loaders and registry persistence, establishes C2 connections, and includes modules that gather system info, check for security products, steal data (screenshots, clipboard contents, documents) and harvest cryptocurrency wallet extension data. Fortinet and Trend Micro provide detailed analysis and IoCs, and attackers tracked as Void Arachne/Silver Fox are associated with these campaigns.