Winos 4.0 Campaign Expands Across Regions with New Malware

FortiGuard Labs has uncovered a sophisticated cross-regional campaign by Winos 4.0 hackers, initially targeting users with phishing PDFs disguised as official documents. The campaign has evolved, using custom domains and multi-stage loaders to deliver the HoldingHands payload. The malware employs DLL sideloading and privilege escalation techniques, making detection challenging. The latest variant includes a new C2 task that updates the server IP address via registry entry, showcasing the group's growing sophistication. Analysts have linked the infrastructure to new campaigns, highlighting the threat actors' reliance on phishing lures and layered evasion tactics.