Loading threat actor…
REF2924 is a state-sponsored espionage intrusion set assessed as China-nexus and linked on technical, operational, and victimological grounds to activity associated with Winnti Group and ChamelGang. The cluster has been observed targeting foreign affairs and telecommunications entities, including an ASEAN member’s foreign ministry and telecommunications providers in Afghanistan, with additional links to Mongolia-focused activity. Its operations indicate sustained strategic intelligence collection rather than financially motivated crime. REF2924 is associated with several malware families and loaders, notably DOORME, SIESTAGRAPH, and SHADOWPAD, and has been observed in environments that also contained related China-aligned tooling. DOORME is a malicious IIS module used to maintain covert access on internet-facing Microsoft server infrastructure. It intercepts inbound web requests before normal IIS processing, authenticates operator traffic, and supports in-memory shellcode execution and interactive command handling. The malware incorporates anti-analysis and obfuscation measures including dynamic API resolution and control-flow obfuscation. SIESTAGRAPH is a .NET backdoor notable for early in-the-wild abuse of Microsoft Graph API for command and control. It uses Microsoft 365 services, including Outlook draft messages and OneDrive, to blend malicious traffic into legitimate enterprise cloud activity. Its functionality includes command execution, file transfer, directory and drive enumeration, process management, network discovery, screenshot capture, configurable beaconing, and self-termination. This tradecraft reflects a preference for stealthy post-compromise collection and cloud-mediated command channels. REF2924 activity also involved a SHADOWPAD loader delivered through DLL sideloading using a legitimate signed application. The loader established persistence as a service, staged encrypted payload material in the registry, injected into spawned processes, and executed shellcode from memory. The use of SHADOWPAD aligns REF2924 with broader Chinese espionage ecosystems that rely on modular remote access tooling, stealthy persistence, and flexible post-exploitation capability. Observed post-exploitation behavior includes mailbox collection from Exchange infrastructure, network and host reconnaissance, shellcode staging and execution, persistence, and covert data exfiltration. The intrusion set’s overlap with other China-linked clusters extends beyond malware reuse to shared strategic targeting priorities and operational patterns. REF2924 has also been linked to the related intrusion set REF5961 through co-resident malware and overlapping victim environments, reinforcing the assessment that it operates within a broader Chinese state-sponsored espionage umbrella.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
24 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Intrusion set referenced for using the SIESTAGRAPH backdoor to access Microsoft 365 Mail via the Microsoft Graph API for command-and-control while targeting the Foreign Affairs Office of an ASEAN member.
A previously reported activity cluster involving an attack on a Southeast Asian foreign ministry and notable for abuse of Microsoft Graph API for command and control.
China-nexus espionage intrusion set targeting government diplomatic entities in ASEAN and likely Mongolian government or NGO victims. Associated with multiple malware families and post-exploitation collection activity.
Intrusion set associated with DOORME, SIESTAGRAPH, and SHADOWPAD, assessed as a nationally aligned group with non-monetary motivations targeting foreign ministry and telecommunications environments.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.