Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.

Operation Cobalt Whisper is a low-severity cyber threat campaign identified through open-source intelligence (OSINT) that targets multiple industries primarily in Hong Kong and Pakistan. The threat actor employs a multi-faceted attack approach leveraging spearphishing with malicious attachments (MITRE ATT&CK T1566.001), delivery of malicious files (T1204.002), and execution of Visual Basic scripts (T1059.005). Persistence is maintained through scheduled tasks (T1053.005), and the attacker uses portable executable injection techniques (T1055.002) to evade detection and maintain foothold. The campaign includes system owner/user discovery (T1033) to gather information about compromised environments and uses web protocols (T1071.001) for command and control communications. The targeted sectors are diverse, including academia, civil aviation, defense, electric and energy utilities, engineering, environmental organizations, IT security firms, pharmacy, and security actors, indicating a broad strategic interest in critical infrastructure and sensitive information. While no specific vulnerabilities or exploits have been identified, the campaign’s use of spearphishing and malicious file execution highlights the reliance on social engineering and user interaction to initiate compromise. The absence of patch availability and known exploits in the wild suggests this is an emerging or ongoing threat rather than a vulnerability with a known fix. The campaign’s low severity rating reflects limited impact or sophistication observed to date but does not preclude escalation or broader targeting in the future.

filename is a placeholder - do not use for detection

translates to “Attachment 2: Regulations on Scientific and Technological Awards of the China Electrotechnical Society (Revised April 2024)

Detailed information about Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan.. Get real-time updates, technical d

Operation Cobalt Whisper: Threat Actor Targets Multiple Industries Across Hong Kong and Pakistan. - Live Threat Intelligence - Threat Radar | OffSeq.com

Operation Cobalt Whisper is a low-severity cyber espionage campaign targeting multiple industries primarily in Hong Kong and Pakistan. The threat actor employs spearphishing attachments (MITRE ATT&CK T1566.001) as the initial infection vector, delivering malicious files (T1204.002) that leverage Visual Basic scripting (T1059.005) to execute payloads. The campaign includes persistence mechanisms such as scheduled tasks (T1053.005) and employs portable executable injection (T1055.002) to evade detection and maintain foothold. Post-compromise activities include system owner/user discovery (T1033) to gather intelligence about the environment and use of web protocols (T1071.001) for command and control communications. The targeted sectors span academia, civil aviation, defense, electric, energy, engineering, environment, IT security, pharmacy, and security actors, indicating a broad multi-sector espionage focus. Although no known exploits in the wild have been reported and the campaign is assessed with a low severity, the use of sophisticated attack patterns and targeting of critical infrastructure and sensitive sectors suggest a persistent threat actor with strategic intent. The campaign's geographical focus on Hong Kong and Pakistan reflects geopolitical interests and regional strategic importance. The technical details indicate a moderate threat level (3 on an unspecified scale) with limited analysis available, and the certainty of the intelligence is moderate (50%).

Title	Severity	Type	Source	Date

Threats Tagged 'misp-galaxy:sector="civil aviation"'

Filter Threats