APT27__2023__Trendmicro_IronTigers-SysUpdate-Adds-Linux-Targeting_03-01-2023.pdf

Trend Micro details an active Iron Tiger APT campaign that updated its SysUpdate malware to add Linux support and new features (multi-stage DLL side‑loading, DES-encrypted configs, DNS TXT tunneling C2), documents a Chrome credential/cookie stealer and use of VMProtect with a stolen certificate, and links the activity to at least one compromised gambling company while providing timelines and IOCs.