Cross-Border Phishing Attacks Spreads Across Asia

Seemingly unrelated attacks targeting Chinese-speakers throughout the Asia-Pacific region with a remote access trojan trace back to the same threat actor, says researchers.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Linking the attacks – spotted in China, Taiwan, Japan and Malaysia – are elements including the HoldingHands Trojan payload, obfuscation techniques and a reliance on the Tencent Cloud storage.

Researchers from Fortinet first detected the campaign targeting Taiwan in January 2025 with different malware, Winos 4.0.

But by February, the threat actor pivoted to new malware families, expanding targeting efforts across Asia, Fortinet said Friday.

“Chinese speakers appear to be a primary focus, as several variants with Chinese names have been found on VirusTotal in the past month,” said Rachael Pei, a Fortinet threat researcher. Hackers’ most likely motivation, he said, is regional intelligence collection “with the malware lying dormant as it awaits further commands.”

Attackers have primarily relied on phishing emails containing infected PDFs that masquerade as correspondence from ministries of finance and other government agencies. These PDFs carried multiple embedded links – most hosted on Tencent Cloud – with unique account IDs that enabled analysts to connect multiple clusters of malicious files to the same actor.

Some later documents imitated government purchase orders, while others posed as tax regulation drafts. One notable file that appeared to target Taiwan redirected victims to a Japanese-language page, prompting a ZIP download. The archive contained an executable deploying HoldingHands – a deliberate multilingual strategy to deceive users in different countries.

Technical clues tied the Japanese and Taiwanese attacks together. Both shared a common command-and-control IP address 156.251.17.9 and used executables bearing legitimate digital signatures to evade detection.

Analysts discovered that the same infrastructure was used in newer campaigns against Malaysia. The domain twczb.com, previously linked to Taiwan-targeted phishing, resolved to the same IP address used in Malaysia-based activity. In this wave, the attackers again relied on phishing pages but introduced a more complex multi-stage infection flow.

Unlike earlier versions that dropped executable files to disk, the latest HoldingHands variant employs Windows Task Scheduler to trigger subsequent attack stages. That makes detection harder, since the malware can execute indirectly through legitimate system processes and minimizes forensic traces and bypasses behavior-based security tools.

The malware chain begins with a malicious executable disguised as a “tax audit document,” which loads a tampered library named dokan2.dll. This file executes sw.dat, which sets up the environment, performs anti-virtual machine checks and attempts to escalate privileges by impersonating the Windows TrustedInstaller service.

The attackers also programmed the malware to identify and respond to installed antivirus software, terminating its activity if Kaspersky is found or dropping decoy DLLs when Norton or Avast is detected.

Once established, the attack chain uses a renamed system file, TimeBrokerClient.dll, to load encrypted shellcode and ultimately deploy the HoldingHands payload. The updated variant includes a new feature enabling attackers to change their command and control server’s IP address remotely through Windows registry entries, an adaptation that improves persistence and flexibility.

Researchers said that the payload maintains many core capabilities from earlier attacks, such as impersonating logged-in users and injecting malicious code into trusted processes like taskhostw.exe but now also has the introduction of indirect execution paths and dynamic infrastructure updates.