This campaign delivers a Telegram-based RAT via a trojanized CHM file posing as a CV document targeting Vietnamese users. The infection uses a multi-stage payload delivery involving Python loaders, C++ DLLs, and XOR encryption to evade detection. Persistence mechanisms include Shell hijacking and scheduled tasks. The RAT leverages the Rebex.Common.dll library to communicate with attackers through the Telegram bot API, enabling remote commands such as file exfiltration, token swapping, and arbitrary command execution. The campaign's complexity and targeting suggest state-sponsored origins. No patch or vendor advisory is available, and no cloud service is involved.

The malware enables remote attackers to execute arbitrary commands, download files, and manipulate tokens on infected systems, potentially leading to data theft, system compromise, and unauthorized access. The use of persistence techniques increases the difficulty of removal. The targeted nature of the campaign suggests potential espionage or surveillance objectives against Vietnamese victims. There are no reports of widespread exploitation or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the absence of official fixes, organizations should focus on user awareness to avoid opening trojanized CHM files, especially those masquerading as CV documents. Monitoring for indicators of compromise such as hashes associated with this campaign and unusual scheduled tasks or Shell hijacking activity is recommended. Since no vendor advisory or patch is available, defensive measures should prioritize detection and containment.