🇨🇳

Operation SalmonSlalom

APT Group Information theft and espionage 1 zero-day CVE ETDA ✓

Also Known As

No alias recorded

Target Countries 10

Countries highlighted in red

China Hong Kong Japan Republic of Korea Malaysia Philippines Singapore Thailand Province of China Taiwan Vietnam

Sectors Targeted

Public Administration 92 Telecommunications Insurance Carriers and Related Activities 524 Healthcare Utilities 22 Government IT NAICS:48 48 Health Care and Social Assistance 62 Construction 23 Financial Other Information Services 519 Manufacturing Information 51 Construction Telecommunications 517 Finance and Insurance 52 NAICS:31 31

Details

Origin 🇨🇳 CN

Last Updated 08 Mar 2025

Related Zero-Days 1

CVE-2025-24200

Known Names 1 entries

Operation SalmonSlalom Kaspersky

Observed Target Countries 10

Based on ETDA data — countries highlighted in red

China Hong Kong Japan Malaysia Philippines Singapore South Korea Taiwan Thailand Vietnam

Description

(Kaspersky) A Kaspersky ICS CERT investigation uncovered a cyberthreat specifically targeting various industrial organizations in the Asia-Pacific region. The threat was orchestrated by attackers using legitimate Chinese cloud content delivery network (CDN) myqcloud and the Youdao Cloud Notes service as part of their attack infrastructure. The attackers employed a sophisticated multi-stage payload delivery framework to ensure evasion of detection. Their techniques included the use of a native file hosting CDN, publicly available packers for sample encryption, dynamic changes in command and control (C2) addresses, a CDN hosting the payload, and the use of DLL sideloading.

Tools Used 1

FatalRAT

Reports & References 1

https://ics-cert.kaspersky.com/publications/reports/2025/02/24/fatalrat-attacks-in-apac-backdoor-delivered-via-an-overly-long-infection-chain-to-chinese-speaking-targets/

ETDA Profile

Operation SalmonSlalom

Origin

China

First Seen 2025

Motivation

Information theft and espionage

View on ETDA APT Groups ↗