X-Industry

FortiGuard Labs recently observed several targeted phishing campaigns in Taiwan that use themes designed to exploit local business processes.  These campaigns disseminate Winos 4.0 (ValleyRat) and subsequent malicious plugins through weaponized attachments or embedded links.  The lures mimic official communications, such as tax audit notifications, tax filing software installers, and cloud-based e-invoice downloads.

In January 2025, our friends at FortiGuard Labs observed an attack that used Winos4.0, an advanced malware framework actively used in recent threat campaigns, to target companies in Taiwan.  Figure 1 shows an example of the attack chain. Usually, there is a loader that is only used to load the malicious DLL file, and the Winos4.0 module is extracted from the shellcode downloaded from its C2 server.

Link to full report:  IR-25-063-002_Winos.pdf