Chinese Hackers Target Taiwan’s Semiconductor Sector with Cobalt Strike, Custom Backdoors

Keypoints

• Chinese threat actors UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp conducted spear-phishing campaigns targeting Taiwanese semiconductor entities.
• Activities include the delivery of Cobalt Strike, Voldemort backdoor, and HealthKick DLL payloads for cyber espionage purposes.
• Attackers employed various social engineering techniques, such as employment-themed emails and credential phishing, to infiltrate target networks.
• Salt Typhoon has infiltrated a U.S. state’s National Guard, collecting sensitive military and infrastructure data over a prolonged period.
• Exploitation of known vulnerabilities in Cisco and Palo Alto Networks devices facilitated initial access for several threat groups.