奇安信威胁情报中心
Excerpt
奇安信威胁情报中心
Background
On December 23, 2025, the renowned document editor EmEditor officially released an announcement stating that between December 19th and 22nd, its official website installation packages were subjected to a supply chain attack. The MSI installation packages were replaced with malicious ones signed with a non-official signature "WALSHAM INVESTMENTS LIMITED":
Qianxin Threat Intelligence Center's RedDrip Team also observed this incident through its private intelligence production process and captured subsequent complete payloads. According to statistics, EmEditor has a considerable user base in China, with many users being developers, operatio…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by QiAnXin on ti.qianxin.com.
More from QiAnXin2
- Threat Actor Mr_Rot13 Actively Exploits CVE-2026-41940 for Backdoor DeploymentQiAnXin · Published 11 May
- 奇安信威胁情报中心QiAnXin · Added 10 Apr
