chinese_apt
A Chinese advanced persistent threat (APT) actor (unspecified group) assessed to be conducting cyber espionage and actively exploiting vulnerabilities in the wild. The actor is reported exploiting CVE-2025-20393, a critical zero-day in Cisco AsyncOS Software used by Cisco Secure Email Gateway products (CVSS 10.0), and the activity is referenced in the CISA Known Exploited Vulnerabilities (KEV) catalog. Separately, reporting notes overlap among Chinese APT groups via shared use of multiple malware families—Zingdoor, ShadowPad, and KrustyLoader—used in global cyber espionage campaigns targeting organizations worldwide, indicating sophisticated and wide-reaching operations. No specific aliases or sub-groups are identified in the provided content.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Observables
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Exploiting a critical zero-day vulnerability (CVE-2025-20393) in Cisco AsyncOS Software for networking gear, specifically targeting Cisco Secure Email Gateway.
Engaged in global espionage operations using a variety of malware tools.
Engaged in complex espionage operations, including targeting critical telecommunications infrastructure, and leveraging AI models to scale operations.
A Chinese APT is leveraging a privilege escalation vulnerability in VMware Tools, for which a zero-day proof-of-concept has been published.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.