Targeted attack on industrial enterprises and public institutions

Kaspersky ICS CERT documents a targeted campaign against Eastern European defense-industrial entities and public institutions, attributed to a Chinese-speaking TA428 group. The operation deploys multiple malware backdoors (PortDoor, nccTrojan, Cotx/DNSep, Logtu, CotSam) and uses techniques such as phishing with CVE-2017-11882, DLL hijacking and process hollowing, domain controller compromise, and staged CnC servers to exfiltrate data collected from compromised systems; the report also lists victims, infrastructure details, and security recommendations.