Operation GriefLure is a sophisticated spear phishing campaign targeting high-level personnel in Vietnam's military telecom sector and Philippine healthcare. It weaponizes authentic and fabricated documents to deliver malicious Windows LNK files within nested RAR archives. The campaign abuses the native Windows ftp.exe binary as a living-off-the-land dropper to deploy polymorphic implants assembled from chunked .doc files directly on disk. These implants establish persistence while showing legitimate decoy PDFs to evade detection. The malware facilitates remote access through process injection, steals credentials from browsers and remote access tools, captures screenshots, and exfiltrates data via HTTPS to command-and-control infrastructure hosted on bulletproof servers in Hong Kong. Indicators include multiple file hashes, domains, and an IP address associated with the campaign. There is no CVE or vendor advisory available, and no known exploits in the wild have been reported.

The campaign compromises targeted systems by establishing persistent remote access, enabling credential theft, screenshot capture, and data exfiltration. This can lead to unauthorized disclosure of sensitive information and potential operational disruption within critical sectors such as military telecommunications and healthcare. The use of authentic documents and living-off-the-land techniques increases the likelihood of successful infiltration and evasion of traditional security controls.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or vendor advisory is provided, organizations should focus on user awareness training to recognize spear phishing attempts, especially those involving legal or whistleblower-themed documents. Monitoring for the identified indicators of compromise (IOCs) such as the listed file hashes, domains (e.g., whatsappcenter.com), and IP addresses can help detect potential infections. Restricting or monitoring the use of native Windows utilities like ftp.exe for suspicious activity may also reduce risk. Incident response teams should analyze suspicious LNK files and nested archives carefully. No official fix or mitigation from vendors is currently documented.