UnknownPublished 24 Oct 2024Updated 9 Dec 2024

type osint · Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Affects type osintSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Impact

For European organizations, the direct impact of Operation Cobalt Whisper may currently be limited due to its geographic focus on Hong Kong and Pakistan. However, the sectors targeted—such as civil aviation, defense, energy, and IT security—are critical and have global interdependencies. European entities operating in or with partners in these regions could face indirect risks, including supply chain compromise, espionage, or disruption of services. The use of spearphishing and malicious attachments poses a risk to user credentials and network integrity, potentially leading to data breaches, intellectual property theft, or operational disruptions. Given the campaign’s targeting of multi-sector environments, European organizations in similar sectors should be vigilant against similar tactics, as threat actors often adapt campaigns to new regions. The persistence and stealth techniques employed could enable prolonged unauthorized access, increasing the risk of data exfiltration and sabotage. The low severity rating suggests current impact is limited, but the potential for escalation or expansion into Europe exists, especially in sectors with strategic importance or geopolitical relevance.

Defensive guidance

European organizations should implement targeted defenses against spearphishing and malicious file attacks beyond generic advice. This includes deploying advanced email filtering solutions capable of detecting and quarantining spearphishing attempts with malicious attachments, and employing sandboxing technologies to analyze suspicious files before delivery. Endpoint detection and response (EDR) tools should be configured to monitor for execution of Visual Basic scripts and unusual scheduled tasks indicative of persistence mechanisms. Network monitoring should focus on detecting anomalous web protocol traffic that could signal command and control communications. User training programs must emphasize recognition of spearphishing tactics specific to the sectors targeted, including simulation exercises tailored to the threat actor’s methods. Organizations should enforce strict application whitelisting to prevent unauthorized execution of injected portable executables and implement least privilege principles to limit the impact of compromised accounts. Regular audits of scheduled tasks and system owner/user discovery activities can help identify early signs of compromise. Collaboration with national cybersecurity centers and sharing of threat intelligence related to Operation Cobalt Whisper can enhance detection and response capabilities.

Indicators of compromise

Domains 10

service-a8vp3r65-1319584009.cd.tencentapigw.com
service-c2y0jtba-1319584009.gz.tencentapigw.com.cn
service-qgezbin5-1319584009.sh.tencentapigw.com
service-h87kxr41-1319584009.bj.tencentapigw.com.cn
service-cyuasu6k-1319584009.nj.tencentapigw.com
service-3z1ebnpd-1319584009.sh.tencentapigw.com
service-b4ibcyjt-1325935989.sh.tencentapigw.com
service-k6iylaqt-1319584009.bj.tencentapigw.com.cn
service-7wu3p58s-1319584009.nj.tencentapigw.com
service-a8vp3r65-1319584009.cd.tencentapigw.com

IP addresses 9

43.137.69.76
139.155.190.198
106.55.77.71
129.204.98.221
119.45.2.30
119.45.67.241
119.45.2.56
139.155.190.84
139.155.190.84

Hashes 135

86543a984e604430fb7685a1e707b2c4
95557088474250a9749b958c3935dee4
95f05674e4cb18a363346b488b67fd38
b8c94d2f66481cc52b30948f65fed761
4cf9bd6af64c3937e156ffb20537a6c1
b2649134fbf0520222263d73b7e985d8
af669dfa074eb9b6fda3fd258f58e2d2
865483fea76242e687aa9e76b1a37f28
432230af1d59dac7dfb47e0684807240
b9d04a61b30ddf53b28bf58a86fc28f5

File 174

%windir%\\syswow64\\dllhost.exeSpawnto_x86
%windir%\\sysnative\\dllhost.exeSpawnto_x64
ImeBroker.exe
PressMe.pdf
malicious.rarfilename is a placeholder - do not use for detection
附件1：《2024年度中国电工技术学会科学技术奖推荐提名书》（技术发明奖和科技进步奖）填报说明(2024年8月新版).pdf.lnk
cache.bak
O365.vbs
subscription.db
附件2：《中国电工技术学会科学技术奖励办法》（2024年4月修订）.pdftranslates to “Attachment 2: Regulations on Scientific and Technological Awards of the China Electrotechnical Society (Revised April 2024)

Regkey 1

“C:\LLVM\bin\LnkFishing\.asset\.asset.pdf“

Link 1

https://www.seqrite.com/blog/operation-cobalt-whisper-targets-industries-hong-kong-pakistan/

Text 4

SEQRITE Labs APT-Team has recently uncovered a campaign targeting various industries such as the Defense Sector in Pakistan and predominantly researchers from Hong Kong. Tracked as Operation Cobalt Whisper, the entire campaign heavily leverages the use of a post-exploitation tool Cobalt Strike, which is deployed using obfuscated VBScript. A total of 20 infection chains have been identified so far along with additional individual samples, where 18 of them target Hong Kong and two target Pakistan where over 30 decoy files have been identified. In this blog, we will explore the technical details of one of the campaigns we encountered during our initial analysis and examine the various stages of the infection chain, starting with a deep dive into the decoy documents. We will then look into the common Tactics, Techniques, and Procedures (TTPs), such as the use of malicious VBScript and LNK payloads employed by this threat actor across most campaigns. These methods facilitate the in-memory execution of the Cobalt Strike implant, which is delivered alongside these lures in an archive file.
Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.
Blog
China

type osint · Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Description

Impact

Defensive guidance

Indicators of compromise

Domains 10

IP addresses 9

Hashes 135

File 174

Regkey 1

Link 1

Text 4

Port 1

As 1

Community reviews

Description

AI analysisMachine-generated, updated 27 Jun 2025, 11:36 UTC

Indicators of compromise

Domains 10

IP addresses 9

Hashes 135

File 174

Regkey 1

Link 1

Text 4

Port 1

As 1

Community reviews

Related threats