Loading story…
Trend Micro reported that the ChessMaster threat actor updated its intrusion toolkit, adding new malware components and refining the tools used to compromise targets. The activity was linked to cyberespionage operations, with the group maintaining persistence through refreshed backdoors and related utilities designed to support long-term access and data collection inside victim environments.
The report indicates the operators continued to evolve their arsenal rather than relying on older implants alone, suggesting an effort to improve stealth, resilience, and operational reach. For defenders, the development highlighted the need to track changes in attacker tooling as closely as known indicators, because incremental malware updates can allow established espionage groups to bypass existing detections and sustain campaigns against selected organizations.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research stating that the ChessMaster threat actor had added updated tools to its arsenal, indicating a development in the group's operational capabilities. No additional dated events are provided in the reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A long-running cyberespionage campaign dubbed **ChessMaster** targeted organizations in Japan across academia, media, technology, managed service providers, pharmaceuticals, and government, using spear-phishing emails and decoy documents to gain initial access. Researchers linked the activity to the China-associated **APT10/menuPass** cluster based on overlapping targeting, shared infrastructure, malware tradecraft, packers, and reuse of known tooling. Early intrusions delivered malware including **ChChes**, **PlugX**, **Poison Ivy**, **RedLeaves**, malicious `.LNK` files, PowerShell-based loaders, and credential-dumping utilities, with some lures spoofing trusted entities and using topical political themes to entice victims. The campaign evolved from first-stage footholds to more selective post-compromise operations, adding the **ANEL** backdoor and the open-source post-exploitation framework **Koadic** while refining loaders, DLL side-loading chains, and command-and-control methods. Delivery techniques included malicious Office documents exploiting `CVE-2017-8759` and `CVE-2017-11882`, as well as abuse of Office features such as `DDEAUTO`, Frameset, and Link Auto Update. Technical reporting described **ChChes** as a sophisticated backdoor that could operate filelessly, profile infected hosts, communicate with C2 servers through HTTP Cookie headers with encrypted data, and stage follow-on payloads, underscoring a sustained and adaptive espionage effort against Japanese targets.
Aug 15, 2026
The **DragonOK** espionage group was linked to a renewed wave of targeted intrusions against organizations in Japan and other parts of Asia, using updated malware families including **PlugX** variants, **Sysget**, **IsSpace**, and **TidePool**. Researchers tied a PlugX variant known as **PIPX** to DragonOK through overlapping command-and-control infrastructure, domain registration patterns, and tradecraft previously associated with the group. The activity primarily targeted manufacturing and high-tech organizations in Japan and Taiwan, while related reporting also identified likely victims in Tibet and Russia. The attacks used phishing emails, malicious executables, and weaponized RTF documents exploiting **`CVE-2015-1641`**, alongside techniques such as **DLL sideloading**, code injection into **`nslookup.exe`**, and persistence through services, autorun registry keys, and PowerShell-based registry changes. DragonOK’s newer tooling showed stronger encryption, anti-debugging and anti-VM protections, altered command-and-control communications, and an unusual method of storing encrypted payloads in registry values such as **`HKLM\SOFTWARE\BINARY`** or **`HKCU\SOFTWARE\BINARY`** instead of loading directly from disk. The combined reporting indicates the group was actively refining its malware and broadening operations while maintaining a strong focus on Japanese targets.
Aug 15, 2026
Earth Baku, a cluster linked to **APT41**, has expanded a long-running cyberespionage campaign against government and enterprise targets from the Indo-Pacific into **Europe** and the **Middle East and Africa**, using a steadily evolving malware arsenal and multiple intrusion paths. Trend Micro reported the group has compromised organizations in sectors including airlines, automotive, infrastructure, media, publishing, IT, and hardware, with activity tied to **SQL injection** on public-facing applications, exploitation of **Microsoft Exchange ProxyLogon** `CVE-2021-26855`, IIS server abuse, and web shells including **China Chopper** and **Godzilla**. Earlier reporting also described possible email-delivered LNK downloader chains and continued operational activity after public law-enforcement scrutiny. The operators have introduced **StealthReacher**, an upgraded loader derived from **StealthVector**, to deploy **SneakCross**, a modular backdoor assessed as the successor to **ScrambleCross** and earlier **Crosswalk**-related tooling. Across reporting, the group was observed using **Cobalt Strike Beacon**, **ShadowPad**, **Natwalk**, **RBRAT**, **Errorroot**, **HIGHNOON**, and other loaders and backdoors, while relying on stealth techniques such as ETW disabling, process and DLL hollowing, module stomping, CFG bypass, early-bird injection, and certificate bypass. Researchers also said Earth Baku hid command-and-control through CDN services, **Cloudflare Workers**, and **Google services**, and supported persistence, tunneling, and exfiltration with customized **iox**, **Rakshasa**, **Tailscale**, and **MEGAcmd**.
Aug 15, 2026