The TAOTH campaign leveraged an abandoned Sogou Zhuyin IME update server and spear-phishing operations to deliver multiple malware families, primarily targeting users across Eastern Asia. Attackers employed sophisticated infection chains, such as hijacked software updates and fake cloud storage or login pages, to distribute malware and collect sensitive information. The campaign focused on high-value targets, including dissidents, journalists, researchers, and technology/business leaders in China, Taiwan, Hong Kong, Japan, South Korea, and overseas Taiwanese communities. Infrastructure and tool analysis link TAOTH to previously documented threat activity, showing shared C&C infrastructure, malware variants, and tactics indicative of a single, persistent attacker group with a focus on reconnaissance, espionage, and email abuse.
The 'Game of Emperor' report details a persistent cyber intrusion campaign by the threat actor 'Earth Estries' targeting sectors such as consulting, managed service providers, NGOs, and telecoms. The campaign affects multiple countries primarily outside Europe, including Afghanistan, Brazil, India, Indonesia, Malaysia, Pakistan, Philippines, South Africa, Taiwan, Thailand, USA, and Vietnam. There are no known exploits or patches associated with this threat. The campaign is ongoing but assessed as medium severity due to its persistence and potential indirect risks to European organizations through global supply chains.
