MalwarePublished 7 Aug 2025

SLOW#TEMPEST Cobalt Strike Loader

Source AlienVault OTX General

Description

An ISO image containing a malicious Cobalt Strike loader was discovered, targeting Chinese-speaking users. The infection chain involves a deceptive LNK file, which executes a legitimate Alibaba executable to sideload a malicious DLL. The loader implements anti-analysis techniques, decrypts an embedded payload, and injects a Cobalt Strike beacon. The beacon is configured to mimic Bilibili traffic and communicates with a specific C2 server. The loader also patches the entry point of the loading executable with an infinite loop. This activity shares similarities with previously reported SLOW#TEMPEST campaigns, including targeting, folder structures, and the use of DLL sideloading for Cobalt Strike beacons.

Impact

For European organizations, the direct targeting of Chinese-speaking users suggests a lower immediate risk; however, the techniques employed by this loader—such as DLL sideloading, process injection, and traffic masquerading—are broadly applicable and could be adapted to target European entities, especially those with business ties to China or Chinese-speaking employees. If deployed in Europe, this malware could lead to unauthorized access, data exfiltration, lateral movement, and persistent footholds within networks. The use of legitimate Alibaba executables for sideloading could bypass traditional signature-based detection, increasing the risk of successful compromise. The mimicry of Bilibili traffic could evade network monitoring tools, complicating incident detection and response. The infinite loop patching could cause denial of service or system instability. European organizations involved in technology, manufacturing, finance, or those with geopolitical relevance may be at increased risk if threat actors expand targeting. Additionally, the presence of anti-analysis techniques complicates forensic investigations and remediation efforts. The medium severity rating reflects the current targeted nature and lack of widespread exploitation but does not diminish the potential impact if adapted or expanded.

Defensive guidance

1. Implement strict controls and monitoring around the execution of LNK files, especially those received via email or external sources, including disabling or restricting the use of LNK files where possible. 2. Employ application whitelisting and restrict execution of unauthorized or unexpected binaries, particularly focusing on Alibaba executables or other known sideloading targets. 3. Monitor for DLL sideloading activities by auditing DLL loads of critical executables and using endpoint detection and response (EDR) solutions capable of detecting anomalous DLL injection or process hollowing. 4. Analyze network traffic for anomalies, including unusual patterns mimicking Bilibili or other streaming services, and implement network segmentation to limit lateral movement. 5. Use behavioral detection tools that can identify anti-analysis techniques and infinite loop patches in executables. 6. Maintain up-to-date threat intelligence feeds to detect indicators of compromise such as the provided hashes and suspicious domains. 7. Conduct regular user awareness training focused on spear-phishing and social engineering tactics involving deceptive shortcuts or ISO images. 8. Employ multi-factor authentication and least privilege principles to limit the impact of potential beacon communications and lateral movement. 9. Establish robust incident response plans that include forensic capabilities to analyze sophisticated loaders and evasive malware. 10. Consider deploying deception technologies to detect and trap such advanced loaders early in the attack chain.

Indicators of compromise

Domains 1

m.123huodong.com.cloud.cdntip.com.s2-web.dogedns.com

Hashes 11

99e99750335c38ca614b390cd4cde0c8
af1e45058dca830b095da6dd8c15b116
f3239582a1a0caf0ab72b13826b250babffbf72e
1cb0560f614cc850422171ffe6b0b9f6b9ceaec4fe3516bc8493f253076470ab
28030e8cf4c9c39665a0552e82da86781b00f099e240db83f1d1a3ae0e990ab6
50fbe429848e16f08a6dbf6ce6d5bbff44db1e009f560e8b8c4cde6cff0a768b
5efbd54a3a51d96fbc8e65815df2f0d95af21a34b99b8dc9a38590fb6d2094f8
6573136f9b804ddc637f6be3a4536ed0013da7a5592b2f3a3cd37c0c71926365
a41c06ad948f3a21496e4d1f6b622ca84a365dd2087b710ed3e7f057e7a2a3f8
c28bd1a57e80861fce2597b1f5155a687bef434b0001632c8a53243718f5f287

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 7 Aug 2025, 11:02 UTC

MITRE ATT&CK techniques17 from threat tags

Technical details

Indicators of compromise

Domains 1

Hashes 11

Community reviews

Related threats