Winnti Evolution - Going Open Source

ProtectWise describes a Winnti (APT17/Wicked Panda) campaign that uses spear-phishing résumé lures to deliver BeEF hooks and Meterpreter payloads (including JAR-delivered macOS components and MSI for Windows), leverages stolen code-signing certificates to sign malware, and operates C2 via lookalike domains and common ports; the post provides TTPs, target profiles (gaming, defense, ISPs), infrastructure indicators (domains and IPs), and attribution to China.