Trusted Design

Targeted Attacks against Tibetan and Hong Kong Groups

概要

This post analyzes targeted malware attacks against groups in the Tibetan diaspora and pro-democracy groups in Hong Kong. All of these attacks leveraged CVE-2014-4114 and were delivered via malicious Microsoft PowerPoint Slideshow files (*.pps). These attacks are highly targeted, appear to re-purpose legitimate content in decoy documents, and had very low antivirus (AV) detection rates at the time they were deployed.

Created: 2026-02-23

Indicators

類似Pulses

Tibetan Uprising Day Malware Attacks (score: 0.70)
A Look at Targeted Attacks Through the Lense of an NGO (score: 0.64)
Years-long espionage campaign against Tibetans (score: 0.64)
Chinese Actors attacks on US Government and EU Media (score: 0.64)
Defending the White Elephant (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

TA2541

Score: 5.12

Matched TTPs:

T1091 - Replication Through Removable Media
T1546.017 - Udev Rules

MITREへのリンク →

Earth Lusca

Score: 5.01

Matched TTPs:

T1091 - Replication Through Removable Media
T1562.011 - Spoof Security Alerting

MITREへのリンク →

Mustang Panda

Score: 9.95

Matched TTPs:

T1091 - Replication Through Removable Media
T1567.002 - Exfiltration to Cloud Storage
T1055.005 - Thread Local Storage

MITREへのリンク →

OilRig

Score: 7.65

Matched TTPs:

T1091 - Replication Through Removable Media
T1212 - Exploitation for Credential Access
T1547.008 - LSASS Driver

MITREへのリンク →

TeamTNT

Score: 6.51

Matched TTPs:

T1091 - Replication Through Removable Media
T1071.003 - Mail Protocols

MITREへのリンク →

Gamaredon Group

Score: 8.28

Matched TTPs:

T1091 - Replication Through Removable Media
T1200 - Hardware Additions
T1546.017 - Udev Rules

MITREへのリンク →

Threat Group-3390

Score: 5.12

Matched TTPs:

T1091 - Replication Through Removable Media
T1546.017 - Udev Rules

MITREへのリンク →

HEXANE

Score: 5.12

Matched TTPs:

T1091 - Replication Through Removable Media
T1212 - Exploitation for Credential Access

MITREへのリンク →

Moonstone Sleet

Score: 4.50

Matched TTPs:

T1091 - Replication Through Removable Media
T1547.008 - LSASS Driver

MITREへのリンク →

Contagious Interview

Score: 4.50

Matched TTPs:

T1091 - Replication Through Removable Media
T1547.008 - LSASS Driver

MITREへのリンク →

FIN7

Score: 4.57

Matched TTPs:

T1091 - Replication Through Removable Media
T1578.001 - Create Snapshot

MITREへのリンク →

EXOTIC LILY

Score: 4.50

Matched TTPs:

T1091 - Replication Through Removable Media
T1547.008 - LSASS Driver

MITREへのリンク →

APT33

Score: 4.13

Matched TTPs:

T1567.001 - Exfiltration to Code Repository

MITREへのリンク →

Wizard Spider

Score: 4.13

Matched TTPs:

T1567.001 - Exfiltration to Code Repository

MITREへのリンク →

Turla

Score: 5.74

Matched TTPs:

T1212 - Exploitation for Credential Access
T1578.001 - Create Snapshot

MITREへのリンク →

Tonto Team

Score: 3.15

Matched TTPs:

T1212 - Exploitation for Credential Access

MITREへのリンク →

admin@338

Score: 3.15

Matched TTPs:

T1212 - Exploitation for Credential Access

MITREへのリンク →

Chimera

Score: 5.74

Matched TTPs:

T1212 - Exploitation for Credential Access
T1578.001 - Create Snapshot

MITREへのリンク →

Volt Typhoon

Score: 5.74

Matched TTPs:

T1212 - Exploitation for Credential Access
T1578.001 - Create Snapshot

MITREへのリンク →

APT37

Score: 3.03

Matched TTPs:

T1562.011 - Spoof Security Alerting

MITREへのリンク →

TA551

Score: 3.03

Matched TTPs:

T1562.011 - Spoof Security Alerting

MITREへのリンク →

Leviathan

Score: 6.19

Matched TTPs:

T1562.011 - Spoof Security Alerting
T1546.017 - Udev Rules

MITREへのリンク →

MuddyWater

Score: 3.03

Matched TTPs:

T1562.011 - Spoof Security Alerting

MITREへのリンク →

Andariel

Score: 3.03

Matched TTPs:

T1562.011 - Spoof Security Alerting

MITREへのリンク →

Tropic Trooper

Score: 6.19

Matched TTPs:

T1562.011 - Spoof Security Alerting
T1200 - Hardware Additions

MITREへのリンク →

BRONZE BUTLER

Score: 5.63

Matched TTPs:

T1562.011 - Spoof Security Alerting
T1578.001 - Create Snapshot

MITREへのリンク →

Lazarus Group

Score: 13.09

Matched TTPs:

T1567.002 - Exfiltration to Cloud Storage
T1055.005 - Thread Local Storage
T1578.001 - Create Snapshot
T1547.008 - LSASS Driver

MITREへのリンク →

Higaisa

Score: 9.59

Matched TTPs:

T1567.002 - Exfiltration to Cloud Storage
T1578.001 - Create Snapshot
T1546.017 - Udev Rules

MITREへのリンク →

APT28

Score: 7.69

Matched TTPs:

T1146 - Clear Command History
T1200 - Hardware Additions

MITREへのリンク →

Dragonfly

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

Confucius

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

Inception

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

DarkHydrus

Score: 3.15

Matched TTPs:

T1200 - Hardware Additions

MITREへのリンク →

Scattered Spider

Score: 4.54

Matched TTPs:

T1027.002 - Software Packing

MITREへのリンク →

CURIUM

Score: 5.12

Matched TTPs:

T1578.001 - Create Snapshot
T1547.008 - LSASS Driver

MITREへのリンク →

Molerats

Score: 3.15

Matched TTPs:

T1546.017 - Udev Rules

MITREへのリンク →

Mofang

Score: 3.15

Matched TTPs:

T1546.017 - Udev Rules

MITREへのリンク →

Medusa Group

Score: 4.54

Matched TTPs:

T1094 - Custom Command and Control Protocol

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Lazarus Group

Score: 0.82

Matched TTPs:

T1578.001 - Create Snapshot
T1547.008 - LSASS Driver
T1055.005 - Thread Local Storage
T1567.002 - Exfiltration to Cloud Storage

MITREへのリンク →

Higaisa

Score: 0.65

Matched TTPs:

T1578.001 - Create Snapshot
T1546.017 - Udev Rules
T1567.002 - Exfiltration to Cloud Storage

MITREへのリンク →

Mustang Panda

Score: 0.65

Matched TTPs:

T1567.002 - Exfiltration to Cloud Storage
T1055.005 - Thread Local Storage
T1091 - Replication Through Removable Media

MITREへのリンク →

Gamaredon Group

Score: 0.55

Matched TTPs:

T1546.017 - Udev Rules
T1200 - Hardware Additions
T1091 - Replication Through Removable Media

MITREへのリンク →

Related CVEs

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る