ELISE: Security Through Obesity - Cyber security updates

This PwC blog analyzes a targeted espionage malware campaign against Taiwanese users: a malicious PowerPoint exploiting CVE-2014-4114 drops a DLL payload (hlwyss.dll/Syncmgr.dll), injects into iexplore.exe, loads a heavily padded 500+MB DAT component likely used to evade AV, and communicates with dynamic DNS C2 hosts (e.g., ustar5.PassAs.us). The report provides behavioral details, file and network IOCs (MD5s, domains, IPs), YARA signatures, and attributes the activity to the Lotus Blossom actor based on language, tooling and configuration similarities.