Tracing SNOWLIGHT: A China-Nexus Campaign Against Government Infrastructure

A China-linked threat group leveraged a sophisticated, automated attack infrastructure—centered around the SNOWLIGHT malware family and a cracked Chinese Cobalt Strike variant—to mass-exploit government and commercial targets in over 100 countries, achieving high-impact endpoint compromises via weaponized CVEs and advanced obfuscation tactics.