The Winos 4.0 malware family, also known as ValleyRAT, has expanded its targeting beyond China and Taiwan to include Japan and Malaysia, utilizing a new remote access trojan (RAT) named HoldingHands RAT (aka Gh0stBins). The campaign employs phishing emails with PDFs that contain embedded malicious links, as reported by Fortinet’s FortiGuard researcher Pei Han Liao.
