Trusted Design

China-based Cyber Threat Group Targets Hong Kong Media Outlets

概要

FireEye Threat Intelligence analysts identified a spear phishing campaign carried out in August 2015 targeting Hong Kong-based media organizations. A China-based cyber threat group, which FireEye tracks as an uncategorized advanced persistent threat (APT) group and other researchers refer to as “admin@338,” may have conduced the activity.[1] The email messages contained malicious documents with a malware payload called LOWBALL. LOWBALL abuses the Dropbox cloud storage service for command and control (CnC). We collaborated with Dropbox to investigate the threat, and our cooperation revealed what may be a second, similar operation. The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.[2][3]

Created: 2026-02-23

Indicators

• CVE - CVE-2012-0158 -
• FileHash-MD5 - 0beb957923df2c885d29a9c1743dd94b -
• FileHash-MD5 - b9208a5b0504cb2283b1144fc455eaaa -
• FileHash-MD5 - 6495b384748188188d09e9d5a0c401a4 -
• FileHash-MD5 - ec19ed7cddf92984906325da59f75351 -
• FileHash-MD5 - 79b68cdd0044edd4fbf8067b22878644 -
• hostname - accounts.serveftp.com -
• FileHash-MD5 - d76261ba3b624933a6ebb5dd73758db4 -

類似Pulses

• Chinese Actors attacks on US Government and EU Media (score: 0.68)
• KingKong.dll - Recent PoisonIvy and PlugX variants targeting South East Asia (score: 0.65)
• Attacks Against the Mongolian Government (score: 0.64)
• SPEAR: A Threat Actor Resurfaces (score: 0.63)
• New Attacks Linked to C0d0s0 Group (score: 0.63)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る