The quoting is the part worth copying into your notes. Positive Technologies records the shortcut's command line as `"C:\Windows\System32\ftp.exe" -""s: _rels\info.dll` [13], and says the Windows parser consumes those quotation marks, which is enough to walk past simple detections written for the `-s` switch [14]. The switch still resolves. The string a rule is looking for is not there.
The archive carrying it was named for an Indonesian-language reference document and held four files: the LNK, `info.dll`, `.rels.log` and `557.pdf` [11]. The hash listed for that PDF is `e3b0c442...b7852b855` [12], which is the SHA-256 of a zero-byte input, so the decoy the victim was supposed to open contained nothing [3]. Anyone triaging the archive by looking at the document finds an empty page and moves on.
The geography deserves a closer read than the summary offers. Positive Technologies names seven primary target countries [2], but says the compromised-site-and-fake-certificate chain is confirmed in four of them: Taiwan, Germany, Indonesia and the Czech Republic [7]. Separately, malicious files were submitted to public sandboxes from Indonesia, the Philippines, Nepal and Taiwan [6]. Only Indonesia and Taiwan appear in both lists [2]. Germany and the Czech Republic rest on the site evidence, Nepal and the Philippines on the submissions, and Egypt on neither of the two [1].
The injected script also carried `/report-url` and `/track-download` functions for collecting infection statistics [9], and the vendor says it did not observe mass infection even though the code would support it [10]. Localised text in both the JavaScript and the SquawkDoor samples points to preparation per country [8]. Counting downloads while holding volume back is how an operator gets conversion data before deciding where the access is worth spending.
The group Positive Technologies also tracks as Salt Typhoon and Earth Estries has been active since 2019, initially against hotels worldwide plus government and international organisations [17], later against telecommunications firms and ISPs in what the vendor reads as a hunt for durable access to lawful intercept systems [18]. A crew with that record serving MSI files from a research library is accepting far more noise than long-term intercept access usually tolerates. The same write-up says the operators made OPSEC mistakes good enough to identify one member involved in preparing the attack [15], and reports overlaps with other East Asian groups [16]. All of it comes from one vendor, and none of it has been corroborated elsewhere in the material we have.
What has not changed is the hinge: a human still has to accept the certificate prompt and run the installer [4]. That step is the only one the operator cannot engineer away.
