Threats Tagged 'lotusharvest'

Operation Hanoi Thief is a spear-phishing campaign targeting Vietnamese IT professionals and recruitment teams. It uses malicious ZIP files containing fake resumes and LNK files that execute a pseudo-polyglot payload. This payload deploys a C++ DLL implant named LOTUSHARVEST via DLL sideloading, which steals browser credentials and history. The stolen data is exfiltrated to attacker-controlled servers. The campaign uses anti-analysis techniques and abuses trusted Windows tools to evade detection. While it shares similarities with Chinese-origin campaigns, state sponsorship is not confirmed. The attack primarily affects Vietnam's IT and recruitment sectors, with no known exploits in the wild beyond spear-phishing. The campaign poses a medium severity threat due to its targeted nature and credential theft capabilities. European organizations are not directly targeted but could be at risk if similar tactics spread. Mitigation requires focused user training, monitoring for DLL sideloading, and blocking known indicators of compromise.

MediumMalwareFranceGermanyNetherlands+2#spear-phishing#it-professionals#lotusharvest