The Deception Project: A New Japanese-Centric Threat

This Cylance report documents a Japanese-focused threat campaign (Snake Wine) involving spear-phishing and LNK-based payloads delivering modular backdoors (Ham Backdoor and Tofu Backdoor), details their capabilities and persistence, and describes a sprawling, evolving C2/DNS infrastructure with numerous IOCs and suspected attribution obfuscation.