China-Linked Espionage Campaigns Target Regional Government and Military Interests
Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen Mar 13, 2026
Security researchers reported multiple China-linked espionage operations, but they are not the same incident. One campaign tracked by Palo Alto Networks as CL-STA-1087 targeted military organizations in Southeast Asia over several years, focusing on intelligence collection related to military capabilities, organizational structures, and cooperation with Western armed forces. The activity used custom malware including the AppleChris and MemFun backdoors and a Getpass credential harvester, alongside stable infrastructure and selective file collection consistent with long-term state-sponsored espionage.
A separate report from Zscaler described a China-nexus intrusion set targeting entities in the Persian Gulf using conflict-themed lures to deliver PlugX. That attack chain relied on a ZIP archive containing a deceptive .lnk file, which downloaded a malicious CHM file, used hh.exe for extraction, displayed a decoy PDF about Iranian missile strikes, and ultimately installed a multi-stage PlugX payload. The other references are unrelated: one is a technical review of CVE-2026-25185 in Windows shortcut handling, and another covers malicious Packagist themes shipping trojanized jQuery tied to FUNNULL infrastructure rather than the China-linked espionage activity described in the relevant reports.
