Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsGrayling is the name Symantec’s Threat Hunter Team gave to a previously unknown, unattributed threat actor whose 2023 campaign focused chiefly on organizations in Taiwan. Symantec also reported apparent victims in the United States, Vietnam and a Pacific-island government agency. The activity is consistent with intelligence gathering, but the available evidence does not establish who operated Grayling or prove that data was stolen.
Who is Grayling?
Grayling is a previously unidentified advanced persistent threat (APT) described by Symantec’s Threat Hunter Team in a report dated 10 October 2023. The name refers to the activity Symantec observed; it is not a confirmed identity or attribution to a known government or group. The reported campaign began in February 2023 and continued through at least May 2023. Symantec did not publish a victim count.
The main reported targets were organizations in Taiwan’s manufacturing, IT and biomedical sectors. Symantec also described apparent victims in the United States and Vietnam, as well as a government agency on a Pacific island. The reporting does not establish how many organizations were affected in each location.
What was Grayling trying to do?
Symantec assessed intelligence gathering as the likely motive. The target sectors and observed tools fit information collection better than financial crime, but motive remains an assessment rather than a proven fact. Symantec said it had not observed data exfiltration. That means the report did not establish that information was taken; it does not prove that no information left any victim’s network.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Attribution is also unresolved. Symantec said it could not definitively link Grayling to a specific geography. It noted that the concentration on Taiwanese organizations suggests an operator from a region with a strategic interest in Taiwan, but this does not identify a country or sponsor. Recorded Future News independently described the activity as espionage-oriented and involving Taiwan, Vietnam, the United States and a Pacific island.
How did the reported attacks work?
Symantec’s account describes several stages, but not every stage was necessarily observed at every victim. Initial access may have involved exploiting public-facing infrastructure. Web shells were found on some victims before the attackers used DLL sideloading, so the report does not establish one uniform entry method across the campaign.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
- Possible initial access: The attackers may have exploited internet-facing infrastructure. Web shells were observed on some compromised systems.
- DLL sideloading and decryption: Grayling’s distinctive execution method used the exported API
SbieDll_Hookto sideload a DLL. A custom decryptor then deployed payloads. - Payload deployment: The reported toolset included a Cobalt Strike stager leading to Beacon, the Havoc framework and NetSpy. Symantec also described an unknown payload decrypted and loaded from
imfsb.ini. - Post-compromise activity: Observed actions included exploiting CVE-2019-0803 for privilege escalation, Active Directory discovery, network scanning, downloading and executing shellcode, and using downloaders. The attackers also killed processes according to
processlist.txtand used Mimikatz for credential dumping.
This sequence is a summary of techniques in Symantec’s report, not a claim that all named tools or actions appeared together on every affected network.
Which tools and vulnerability did Symantec name?
| Name | What it is | Role reported in the Grayling activity |
|---|---|---|
| Havoc | Open-source post-exploitation command-and-control framework | Included among the reported payloads and tools |
| Cobalt Strike | Legitimate penetration-testing software that attackers also abuse | A stager led to Beacon |
| NetSpy | Publicly available spyware | Included in the reported toolset |
| Mimikatz | Publicly available credential-dumping tool | Used for credential dumping |
| CVE-2019-0803 | Windows Win32k elevation-of-privilege vulnerability | Reportedly used for privilege escalation |
The presence of a legitimate security tool such as Cobalt Strike is not, by itself, proof of compromise. These tools can have legitimate uses, so defenders should assess how and where they were run alongside other evidence.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What should defenders investigate?
Symantec published file and network indicators in its report. Security teams should use those indicators from the original report, where available, and correlate them with endpoint, identity and network telemetry. The behavioral clues below are drawn from the reported techniques; none alone identifies Grayling.
- Web shells on public-facing systems: Review unexpected files or changes on internet-exposed servers and investigate suspicious processes or connections associated with them.
- Unusual DLL sideloading: Look for unexpected DLL loads and investigate the originating executable, its location, signature and parent process. Give particular attention to activity associated with
SbieDll_Hookand custom decryption behavior. - Unexpected post-exploitation tools: Check for unauthorized use of Havoc, Cobalt Strike Beacon, NetSpy or Mimikatz. Validate approved penetration testing and administrative activity before treating a tool name alone as an incident.
- Privilege escalation and credential access: Review suspicious attempts involving CVE-2019-0803, credential-dumping behavior and access to sensitive authentication material.
- Discovery and lateral movement preparation: Investigate unusual Active Directory queries, network scanning, shellcode downloads or execution, and downloader activity.
- Process termination: Examine unexplained attempts to kill processes, including activity that appears to follow a process list such as
processlist.txt. - Correlate rather than rely on a single clue: The combination and timing of web-shell evidence, sideloading, discovery and credential access can provide more context than any one artifact. Preserve relevant endpoint and network records for incident investigation.
Symantec said its endpoint products can detect and block malicious files when available. That is a vendor statement, not a guarantee that a particular product or configuration will detect every Grayling-related artifact; organizations should validate detections against their own telemetry and response procedures.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
What is known—and what remains unproven?
- Reported: A campaign from February 2023 through at least May 2023, with Taiwan as its main observed focus and apparent victims in the United States, Vietnam and a Pacific-island government agency.
- Assessed: Intelligence gathering was the likely motive.
- Not established: The operator’s identity or geography, a precise victim count, or confirmed data exfiltration.
These qualifications matter: Grayling is a useful label for a documented cluster of activity, but it should not be treated as a confirmed country-backed group or as proof that information was removed from victims’ systems.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
