operation_hanoi_thief_threat_actor

Operation Hanoi Thief is a threat actor identified by SEQRITE Labs, responsible for a targeted spear-phishing campaign against Vietnamese IT and recruitment professionals. The actor employs spear-phishing emails with ZIP attachments containing a malicious LNK shortcut and a pseudo-polyglot file masquerading as a resume. The infection chain abuses Windows LOLBINs (e.g., ftp.exe, DeviceCredentialDeployment.exe) to execute hidden scripts and evade detection. The final payload, LOTUSHARVEST, is a C++ DLL implant delivered via DLL sideloading (using ctfmon.exe), functioning as an information stealer that harvests browser credentials and history from Chrome and Edge. Exfiltration is performed via HTTPS POST to attacker-controlled infrastructure, using random subdomains on domains such as requestrepo.com and pipedream.net. The campaign demonstrates anti-analysis techniques (virtual environment and debugger checks), masquerading, and signed binary proxy execution. Attribution analysis suggests a Chinese-origin threat actor, based on TTP overlaps with previous campaigns, but there is no confirmation of state sponsorship. The campaign is notable for its use of information stealer implants, social engineering, and technical evasion, and was first observed in November 2025. Known aliases or sub-groups are not specified.