{"id":110635,"date":"2026-01-15T22:28:48","date_gmt":"2026-01-15T22:28:48","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2026\/01\/15\/china-spies-used-maduro-capture-as-lure-to-phish-us-agencies-the-register\/"},"modified":"2026-01-15T22:30:00","modified_gmt":"2026-01-15T22:30:00","slug":"china-spies-used-maduro-capture-as-lure-to-phish-us-agencies-the-register","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2026\/01\/15\/china-spies-used-maduro-capture-as-lure-to-phish-us-agencies-the-register\/","title":{"rendered":"China spies used Maduro capture as lure to phish US agencies \u2022 The Register"},"content":{"rendered":"

<\/a>\n<\/p>\n

\n

What coverage wonk would not wish to click on on an attachment promising to unveil US plans for Venezuela? Chinese language cyberspies used simply such a lure to focus on US authorities businesses and policy-related organizations in a phishing marketing campaign that started simply days after an American navy operation captured Venezuelan President Nicol\u00e1s Maduro.<\/p>\n

Acronis Risk Analysis Unit found the marketing campaign after discovering a zipper file named “US now deciding what’s subsequent for Venezuela” uploaded in early January to VirusTotal. It contained a official executable and a hidden, DLL-based backdoor referred to as Lotuslite.<\/p>\n

This mix, together with different components resembling infrastructure and technical overlaps, helped the safety sleuths attribute the phishing marketing campaign with “reasonable confidence” to a Beijing-backed espionage crew referred to as Mustang Panda<\/a> (aka UNC6384, Twill Hurricane).<\/p>\n

\n