Storm Cloud Unleashed: Tibetan Focus of Highly Targeted Fake Flash Campaign
Summary: Volexity tracked strategic web compromises beginning in May 2019 in which a Chinese APT it calls Storm Cloud injected obfuscated JavaScript into more than two dozen Tibetan websites to serve fake Adobe Flash update prompts to a limited subset of visitors. The campaign used no exploits, instead fingerprinting visitors via WebRTC and api.ipify.org and delivering payloads including GOSLU, Stitch, and BrainDamage, with related SpyNote Android APKs also identified.
Bottom line: The operators maintained this infrastructure across Windows and Android for over a year, continuously rewriting malware and rotating GitHub and Dynamic DNS hosting - a resource gap Volexity says should not be understated against those trying to prevent the attacks.
Read the original at Volexity Blog ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026