"China-linked Hackers Target Guyana Government with DinodasRAT in Operation Jacana"

A governmental entity in Guyana has been targeted in a cyber espionage campaign called Operation Jacana. The attack involved a spear-phishing email that led to the deployment of a previously undocumented implant called DinodasRAT. The campaign is attributed with medium confidence to a China-nexus adversary due to the use of the remote access trojan PlugX. The attackers used a combination of DinodasRAT and traditional backdoors like Korplug, and they tailored their emails to entice their chosen victim organization. The attackers are monitoring the geopolitical activities of their victims to increase the success of their operation.