Targeted Attack Leverages India-China Border Dispute

Zscaler ThreatLabZ identified a spearphishing campaign using a malicious Word attachment ('India-China border tensions.doc') that executes obfuscated macros and PowerShell to run DKMC-style, fileless shellcode which retrieves a GIF-embedded Cobalt Strike beacon over HTTPS (using fake Host headers); the report includes C2 IPs, beacon configs, hashes, and mapped MITRE ATT&CK TTPs.