Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Evolving Tactics of SLOW#TEMPEST: A Deep Dive Into Advanced Malware Techniques

Summary: Unit 42 Palo Alto Networks reported in late 2024 a malware variant tied to the SLOW#TEMPEST campaign, distributed as an ISO file containing 11 files, two of them malicious. The loader DLL zlibwapi.dll is side-loaded by the legitimate signed DingTalk.exe, decrypts a payload appended to a separate ipc_core.dll, and uses control-flow-graph obfuscation with 10 dynamic JMP RAX dispatchers plus indirect Call RAX function resolution to defeat analysis.

Key Takeaway: The loader only unpacks and runs its payload in memory if the target machine reports at least 6 GB of RAM via GlobalMemoryStatusEx, so sandboxes provisioned below that threshold will see nothing. Separating the loader from the payload also means the malicious code executes only when both binaries are present, which complicates detection for anyone scanning files in isolation.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026