Malicious Multilingual ZIP Files Strike Banks and Government Offices

A sophisticated phishing campaign leveraging multilingual ZIP file lures has emerged across East and Southeast Asia, targeting government institutions and financial organizations with unprecedented coordination.

Security researchers utilizing Hunt.io’s AttackCapture™ and HuntSQL™ datasets have uncovered an interconnected network of 28 malicious webpages operating across three language clusters, revealing a scalable, automation-driven infrastructure designed to deliver staged malware payloads disguised as legitimate bureaucratic documents.

The campaign represents a significant evolution in regional cyber threats, demonstrating how adversaries are recycling identical web components—including scripts, page titles, and file naming conventions—across Chinese, Japanese, and English-language variants.

This multilingual approach enables threat actors to cast a wider net across Taiwan, Hong Kong, Japan, Indonesia, Malaysia, and other Southeast Asian nations, adapting their social engineering tactics to match local administrative and financial contexts.

Analysis of the campaign infrastructure reveals a remarkably consistent technical pattern. All identified webpages employ identical backend logic utilizing download.php and visitor_log.php scripts, indicating centralized deployment through an automated toolkit or builder.

The hosting infrastructure predominantly relies on Kaopu Cloud HK Limited (AS138915), with servers distributed across Tokyo, Singapore, Hong Kong, Thailand, and Cambodia—strategically positioned to support regional operations.

The Chinese-language cluster consists of 12 webpages delivering ZIP and RAR archives with filenames mimicking tax invoices, import-export declarations, financial confirmation forms, and regulatory documents written in Traditional Chinese.

These pages primarily target users in Taiwan and Hong Kong, employing titles such as “文件下載” (File Download) to establish legitimacy.

The English-language cluster, also comprising 12 webpages, targets Southeast Asian corporate environments with filenames referencing tax filing documents and employee position adjustments, while four Japanese-language pages complete the operation with lures focused on salary system reviews and National Tax Agency notices.

Researchers identified the campaign by pivoting from known malicious domains documented in earlier Fortinet threat intelligence reports.

Starting with reference domain “zxp0010w[.]vip,” investigators used HuntSQL queries to correlate similar page structures, titles, and scripting patterns across regions.

This methodology revealed that domains sharing characteristics like .vip, .sbs, .cc, and .cn extensions consistently delivered the same malicious framework with only superficial language and filename modifications.

Evolution From Earlier Campaigns

The current operation builds upon phishing waves documented throughout 2024 and early 2025, when threat actors initially deployed Winos 4.0 malware in Taiwan before expanding to distribute the HoldingHands malware family across broader Asian territories.

Open port analysis reveals SSH (port 22) running OpenBSD OpenSSH 8.0, first observed in January 2023 and still active as of October 2025, indicating a long-lived server potentially used for persistent infrastructure or remote administration.

Earlier campaigns relied on cloud hosting services like Tencent Cloud, but operators have since transitioned to custom domain infrastructure embedding regional markers such as “tw” for Taiwan and “jp” for Japan.

The shift demonstrates increasing sophistication in operational security and infrastructure management.

By maintaining multiple language-specific clusters under unified backend control, adversaries can simultaneously test social engineering themes, rotate domains rapidly to evade blocklists, and maintain persistent access to compromised environments across diverse geographic and linguistic boundaries.

Security teams should implement proactive domain blocking for discovered indicators and monitor for emerging domains following similar naming patterns.

Organizations can leverage Hunt.io’s continuous monitoring capabilities to query for newly observed phishing pages containing characteristic download.php or visitor_log.php endpoints, enabling early detection of infrastructure reuse.

Network defenders should configure mail gateways to detect ZIP and RAR attachments with HR, tax, or finance-themed filenames, particularly those arriving in unexpected languages or contexts.

User awareness training remains critical, emphasizing recognition of fake official document downloads and limiting execution privileges for scripts and compressed files from untrusted sources.

These multilingual campaigns underscore the importance of cross-regional threat intelligence sharing to combat adversaries operating at scale across linguistic and geographic boundaries.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.