Operation SalmonSlalom is a campaign, first reported in February 2025, attributed with medium confidence to a Chinese-speaking threat actor targeting industrial organizations and government agencies across the Asia-Pacific region. This operation is distinguished by its sophisticated multi-stage payload delivery framework that actively leverages legitimate Chinese cloud services like myqcloud CDN and Youdao Cloud Notes for hosting and command-and-control infrastructure. The campaign's name, 'SalmonSlalom,' metaphorically represents the attackers' ability to navigate and bypass cyber defenses by maneuvering through obstacles like a salmon swimming upstream. Unlike many financially motivated groups, Operation SalmonSlalom focuses on data theft, remote administration, and device manipulation, indicating an espionage-driven motivation rather than direct financial extortion.

Actores similares

influence-operationsactor · 1Operation Wocaoapt · 1Operation Ghostwriterapt · 0Operation C-Majorapt · 0Operation Silent Skimmerapt · 0Operation Cobalt Whisperapt · 0Operation RusticWebapt · 0Operation LiberalFaceapt · 0Operation Olympic Gamesapt · 0Operation Digital Eyeapt · 0