{
  "name": "NSIS Abuse and sRDI Shellcode: Anatomy of the Winos 4.0 Campaign",
  "slug": "nsis-abuse-and-srdi-shellcode-anatomy-of-the-winos-40-campaign",
  "description": "A malware campaign using fake software installers to deliver Winos v4.0, a memory-resident malware, has been tracked throughout 2025. The campaign, dubbed Catena, employs trojanized NSIS installers, reflective DLL loading, and shellcode-embedded INI files to evade detection. It stages payloads entirely in memory, connecting to attacker-controlled servers mainly in Hong Kong. The operation appears focused on Chinese-speaking environments and shows signs of long-term planning by a capable threat group. The infection chain involves multiple stages, including initial NSIS installers, first-stage loaders, and second-stage payloads, ultimately delivering the Winos v4.0 stager. The campaign has evolved over time, adapting its tactics to avoid detection while maintaining core infrastructure and execution logic.",
  "published": "2025-05-27T21:59:06+00:00",
  "created_at": "2025-05-27T21:59:06+00:00",
  "modified_at": "2025-05-28T11:16:09+00:00",
  "created_at_opencti": "2025-05-27T21:59:06+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2025-05-27",
    "catena loader",
    "chinese-speaking targets",
    "memory-resident malware",
    "nsis",
    "reflective dll injection",
    "srdi",
    "trojanized installers",
    "winos",
    "winos v4.0"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "43.226.125.44"
      },
      {
        "id": "",
        "name": "202.79.173.98"
      },
      {
        "id": "",
        "name": "202.79.173.50"
      },
      {
        "id": "",
        "name": "202.79.171.133"
      },
      {
        "id": "",
        "name": "156.251.17.243"
      },
      {
        "id": "",
        "name": "143.92.63.144"
      },
      {
        "id": "",
        "name": "143.92.61.154"
      },
      {
        "id": "",
        "name": "137.220.229.34"
      },
      {
        "id": "",
        "name": "134.122.204.11"
      },
      {
        "id": "",
        "name": "112.213.101.161"
      },
      {
        "id": "",
        "name": "112.213.101.139"
      },
      {
        "id": "",
        "name": "103.46.185.73"
      },
      {
        "id": "",
        "name": "103.46.185.44"
      },
      {
        "id": "",
        "name": "27.124.40.155"
      },
      {
        "id": "",
        "name": "202.79.173.54"
      },
      {
        "id": "",
        "name": "202.79.168.211"
      },
      {
        "id": "",
        "name": "112.213.116.91"
      },
      {
        "id": "",
        "name": "e2490cfd25d8e66a7888f70b56ff8409494de3b3d87bc5464d3adabba8b32177"
      },
      {
        "id": "",
        "name": "e036d5e88a51008b130673ad65872559c060deeb29a0f8da103fe6d036e9d031"
      },
      {
        "id": "",
        "name": "d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0"
      },
      {
        "id": "",
        "name": "ba0fd15483437a036e7f9dc91a65caa6e9b9494ed3793710257c450a30b88b8a"
      },
      {
        "id": "",
        "name": "b22599dd0a1c44ca1b35df16006f3085bddae3ebba6a3649ec6e4dc4cbf74865"
      },
      {
        "id": "",
        "name": "b8e8a13859ed42e6e708346c555a094fdc3fbd69c3c1cb9efb43c08c86fe32d0"
      },
      {
        "id": "",
        "name": "5767d408ec37b45c7714d70ae476cb34905ad6b59830572698875fc33c3baf2f"
      },
      {
        "id": "",
        "name": "4fdedadaa57412e242dc205fabdca028f6402962d3a8af427a01dd38b40d4512"
      },
      {
        "id": "",
        "name": "4cb2cab237893d0d661e2378e7fe4e1bafbfaefd713091e26c96f7ec182b6cd0"
      },
      {
        "id": "",
        "name": "47ad38adc3b18fb62a8e0a33e9599fd0b90d9de220d1a18b6761d035448c378f"
      },
      {
        "id": "",
        "name": "28d2477926de5d5a8ffcb708cb0c95c3aa9808d757f77b92f82ad4aa50a05cc8"
      },
      {
        "id": "",
        "name": "1e57ac6ad9a20cfab1fe8edd03107e7b63ab45ca555ba6ce68f143568884b003"
      },
      {
        "id": "",
        "name": "16c79970ed965b31281270b1be3f1f43671dfaf39464d7eac38b8b27c66661cf"
      },
      {
        "id": "",
        "name": "01e72332362345c415a7edcb366d6a1b52be9ac6e946fb9da49785c140ba1a4b"
      }
    ],
    "malware": [
      {
        "id": "08448562-4dfc-464c-88e9-9b7fa4fa7633",
        "name": "Catena loader",
        "slug": "catena-loader"
      },
      {
        "id": "3723e9db-02e5-4ca5-93f6-f4ae2957bf7c",
        "name": "Winos v4.0",
        "slug": "winos-v40"
      }
    ],
    "intrusion_sets": [
      {
        "id": "ec413ff2-29be-48ab-aed2-aae30411e236",
        "name": "Silver Fox APT",
        "slug": "silver-fox-apt"
      }
    ],
    "attack_patterns": [
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "81b422de-709e-43bd-b471-2befac0c623a",
        "name": "T1218.011"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "196f2a64-c55b-47a6-8e38-beb76ba700b6",
        "name": "T1204.002"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Hong Kong"
      },
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Technology"
      }
    ]
  },
  "external_refs": [
    "https://www.rapid7.com/blog/post/2025/05/22/nsis-abuse-and-srdi-shellcode-anatomy-of-the-winos-4-0-campaign",
    "https://otx.alienvault.com/pulse/683651cab88138e6609c3788"
  ]
}