SLOWTEMPEST

An intrusion cluster, also written SLOW#TEMPEST, reported targeting Chinese-speaking users. It uses phishing archives, malicious shortcuts, DLL side-loading, Cobalt Strike, and credential-dumping tools to establish persistence and move laterally; its sponsorship has not been firmly established publicly.