Analysis on APT-to-be Attack That Focusing on China's Government Agency

ANTiY Labs reports on an APT operation named APT-TOCS targeting a Chinese government agency, using a Cobalt Strike Beacon-based framework and PowerShell-driven, multi-stage shellcode to download and execute encrypted modules in memory. The analysis covers leading files, sample data, modules, and data packets, and notes the use of a commercial attack platform to enable covert, persistent access with periodic heartbeats and C2 communications.