Attackers deliver phishing emails luring targets into installing the fraudulent GlobalProtect tool, which when executed triggers in-background malware loading during the setup process.
APT32's most recent attacks involved the compromise of four hosts with different Windows Registry keys and scheduled tasks that facilitated the deployment of Google Chrome cookie exfiltration, Cobalt Strike beacons, and embedded DLL payload loaders.