Chinese State-Sponsored Hackers Launch Cobalt Strike Attacks on Semiconductor Industry

Proofpoint Threat Research identified a surge in sophisticated phishing campaigns targeting the Taiwanese semiconductor sector, led by three China-aligned, state-sponsored threat actors.

These campaigns, observed at levels above the historical norm, demonstrate a strategic pivot by Chinese espionage groups towards critical Taiwanese semiconductor organizations and their supporting ecosystems, highlighting an increased prioritization by China for semiconductor technology intelligence.

This escalation comes against the backdrop of intensifying US and Taiwanese export controls, directly affecting China’s ambitions for semiconductor self-sufficiency.

Multi-Stage Infection Chains

The campaign activity included attackers tracked as UNK_FistBump, UNK_DropPitch, and UNK_SparkyCarp.

UNK_FistBump focused spearphishing against recruitment and HR teams across Taiwan-based semiconductor manufacturing, packaging, and testing firms, often leveraging compromised Taiwanese university accounts.

Attackers delivered password-protected ZIP or PDF documents containing links to externally hosted archives, with payloads shifting from standard Cobalt Strike Beacons to the custom Voldemort backdoor as the campaign evolved.

UNK_FistBump’s attack chains cleverly exploited DLL sideloading vulnerabilities in benign signed executables (such as javaw.exe and CiscoCollabHost.exe) to load malicious payloads.

These chains enabled memory-resident Cobalt Strike or Voldemort malware, providing covert command and control channels, with Voldemort notably leveraging Google Sheets for communications.

Proofpoint notes overlaps with techniques and tooling from the established TA415 (APT41/Brass Typhoon) group, though differences in loader and infrastructure usage led researchers to treat UNK_FistBump as a distinct entity for now.

Meanwhile, UNK_DropPitch launched targeted phishing attacks on financial analysts within major investment banks tracking the Taiwanese semiconductor market.

These campaigns distributed ZIP files with vulnerable executables and custom DLLs, culminating in the deployment of simple backdoors such as HealthKick and raw TCP reverse shells.

Subsequent post-compromise activity included the installation of remote management tools, like Intel Endpoint Management Assistant, for persistent access.

UNK_DropPitch’s infrastructure exhibited further links to Chinese espionage tools, including use of TLS certificates and VPS hosting characteristics associated with APT41’s SideWalk malware family.

Credential Harvesting

Proofpoint also reported activity from UNK_SparkyCarp, which in March 2025 executed an adversary-in-the-middle (AiTM) credential phishing campaign, using bespoke frameworks and lure pages to compromise authentication data from targeted Taiwanese semiconductor companies.

This wave reflects a wider trend: as established Chinese threat actor TTPs shift toward exploiting edge devices, a new generation of China-aligned clusters are intensifying their focus on phishing-based initial access against high-value technology sector targets.

These observed intrusions underscore a notable expansion in Chinese cyberespionage initiatives, specifically calibrated to Taiwan’s semiconductor industry and its value chain.

By expanding targeting to include not only chip manufacturers and design houses, but also downstream supply chain players and financial analysis professionals, Chinese state-sponsored threat groups are broadening their intelligence collection efforts to support long-term strategic priorities.

Indicators of Compromise (IOCs)

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates