Chinese Espionage Campaign CL-UNK-1068 Targeting Asian Critical Infrastructure via Web Server Exploitation

Palo Alto Networks Unit 42 reported a previously undocumented Chinese threat actor, tracked as CL-UNK-1068, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across South, Southeast, and East Asia. Targeted sectors include aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications, with Unit 42 assessing moderate-to-high confidence that the primary objective is cyber espionage (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution.

The activity features exploitation of internet-facing web servers to deploy web shells and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and living-off-the-land binaries (LOLBINs). Reported tooling includes Godzilla and ANTSWORD web shells, the Xnote Linux backdoor, and Fast Reverse Proxy (FRP) for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., c:\inetpub\wwwroot) focusing on files such as web.config, .aspx, .asmx, .asax, and .dll, consistent with credential access and follow-on exploitation discovery.