Winos 4.0 hackers expand to Japan and Malaysia with new malware

Winos 4.0 attackers have expanded from China and Taiwan to Japan and Malaysia, using PDFs masquerading as documents from the Finance Ministry to deliver the HoldingHands RAT (aka Gh0stBins). The campaign relies on phishing emails with PDFs containing embedded malicious links, and Tencent Cloud links were used as part of the infrastructure, with unique account IDs allowing analysts to trace multiple phishing files to the same threat operators.

Fortinet researchers linked recent Malaysia activity to earlier Taiwan campaigns, noting a shift to a multi‑stage flow that triggers via the Windows Task Scheduler and hides download links in JSON data to evade detection. The attackers sign EXE files to bypass detection and deploy a Dokany-named shellcode loader (dokan2.dll) along with sw.dat, dropping components into C:\Windows\System32 and using token theft to elevate privileges.

A new IP‑update command (0x15) and a modified kill/terminate command (0x17) were observed, with HoldingHands config found under HKEY_CURRENT_USER\SOFTWARE\HHClient and AdrrStrChar storing the server IP. According to Fortinet’s report, threat actors continue to rely on phishing lures and layered evasion, linking campaigns across China, Taiwan, Japan and Malaysia.