China-Linked Bronze Starlight Group Targeting Gambling Sector with Cobalt Strike Beacons
![Image](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVnKAMpsaf726sAMAdEW_i4_-YBpeEHkWcZoBU2vbYVuqQ4Kbv3mMdqwYxA_GGHQadquuGCIw10-4yI1N2Y8UJliTSkHGdaupXjV-WFVXZa-wN-Rb8Z-C2863ia-zemX7zxVYMPPA7GohgVLVLZ6SQPpPkYxYMhIp27R9_moWbk60-cOETLQB6mz66NEk/w640-h334/play.jpg)
An ongoing cyber attack campaign originating from China is targeting the Southeast Asian gambling sector to deploy Cobalt Strike beacons on compromised systems. Cybersecurity firm SentinelOne said the tactics, techniques, and procedures point to the involvement of a threat actor tracked as Bronze Starlight (aka Emperor Dragonfly or Storm-0401), which has been linked to the use of short-lived ransomware families as a smokescreen to conceal its espionage motives. "The threat actors abuse Adobe Creative Cloud, Microsoft Edge, and McAfee VirusScan executables vulnerable to DLL hijacking to deploy Cobalt Strike beacons," security researchers Aleksandar Milenkoski and Tom Hegel said in an analysis published today. It also bears noting that the campaign exhibits overlaps with an intrusion set monitored by ESET under the name Operation ChattyGoblin. This activity, in turn, shares commonalities with a supply chain attack that came to light last year leveraging a trojanized installer