Chinese hacking groups target Russian government, IT firms

Kaspersky uncovered "EastWind," a targeted July 2024 cyberespionage campaign attributed to APT31 and APT27 that used phishing with RAR attachments and DLL side‑loading to drop updated CloudSorcerer, GrewApacha, and a new PlugY backdoor; the malware employs VMProtect, machine‑bound key generation, and public-profile C2 techniques to evade detection, with observable indicators such as large DLLs in C:\Users\Public, unsigned msedgeupdate.dll, and per-user msiexec.exe processes.