FortiGuard Tracks HoldingHands Malware Shift: Cross-Regional APT Uses Task Scheduler Hijack to Evade Detection

FortiGuard Labs has uncovered a cross-regional campaign that expanded from China to Taiwan, Japan and most recently Malaysia, with attackers evolving their methods over time. According to FortiGuard Labs, the group began with phishing PDFs posing as Taiwan’s Ministry of Finance documents, delivering links hosted on Tencent Cloud, before moving to custom domains containing a “tw” string to spread malware via government or business documents.

The same C2 infrastructure was observed across Taiwan and Japan, and the 2025 variant introduced a new server IP update mechanism via a registry entry, enabling the attackers to shift infrastructure without redeploying the malware. The campaign uses multi-stage loaders and DLL sideloading, with a loader named dokan2.dll that sets up the environment for sw.dat, checks system RAM, impersonates TrustedInstaller for privilege escalation, and enumerates security software such as Norton, Avast and Kaspersky.

When antivirus processes are not detected, the actors hijack the Windows Task Scheduler to achieve persistence, loading TimeBrokerClient.dll through svchost.exe and launching the HoldingHands backdoor under the taskhostw.exe process. By mid-2025, activity extended to Malaysia, where the same infrastructure reappeared, and HoldingHands employed Task Scheduler triggers to evade detection.