Loading story…
Sophos reported that Operation Crimson Palace uncovered multiple clusters of suspected Chinese state-sponsored activity targeting government organizations in Southeast Asia. The campaign involved sustained intrusions rather than a single incident, with threat hunters linking separate but related activity sets to espionage-focused operations against public-sector networks in the region.
The findings indicate coordinated access, persistence, and follow-on activity across victim environments, underscoring a broad intelligence-collection effort aimed at Southeast Asian government entities. Sophos said the operation reflects overlapping Chinese threat activity and highlights the continued focus of state-backed actors on regional government systems for long-term strategic surveillance.
TTPs, infrastructure, and targeting history in one profile.
2 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published research on a suspected China-based espionage campaign targeting military targets in Southeast Asia. The report publicly disclosed the operation and expanded reporting on suspected Chinese cyber-espionage activity in the region.
Sophos Threat Research published a report describing Operation Crimson Palace as multiple clusters of suspected Chinese state-sponsored activity targeting a Southeast Asian government. The reference indicates the campaign and its targeting were publicly disclosed in this report.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
origin-unit42.paloaltonetworks.com
Open sourcesophos.com
Open sourcenews.sophos.com
Open sourcenews.sophos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 disclosed a long-running cyberespionage campaign, tracked as **CL-STA-1087**, that has targeted military organizations across Southeast Asia since at least 2020. The intrusions were aimed at collecting highly specific intelligence on military capabilities, organizational structures, **C4I** environments, joint military efforts, official meeting records, and cooperation with Western armed forces, rather than conducting broad data theft. Researchers said the activity was first uncovered after suspicious PowerShell behavior on an unmanaged endpoint exposed an already-established foothold, with the attackers using delayed execution, dormant periods lasting months, and reverse shells to preserve stealth and support long-term access. The operation used custom malware including the **AppleChris** backdoor, the in-memory **MemFun** backdoor, and **Getpass**, a modified Mimikatz-based credential theft tool. Investigators reported tradecraft including DLL hijacking, process hollowing, reflective DLL loading, timestomping, malicious Windows service creation, and lateral movement with WMI and native .NET tooling across domain controllers, web servers, IT workstations, and executive systems. Command-and-control traffic was hidden through dead-drop resolvers on legitimate services such as **Pastebin** and **Dropbox**, while infrastructure patterns, UTC+8 working hours, China-based cloud hosting, and Simplified Chinese artifacts led researchers to assess the campaign with moderate confidence as China-linked state-backed espionage.
Jun 29, 2026
Check Point Research reported that the Chinese espionage group **Sharp Dragon**—previously tracked as **Sharp Panda**—has expanded operations from earlier activity in Southeast Asia to target government organizations in **Africa and the Caribbean**. The campaign uses highly tailored phishing emails and weaponized documents to gain initial access, continuing a pattern of government-focused intrusion activity previously associated with the group. Researchers said the actor has shifted from custom malware including **VictoryDLL** and the **Soul** framework to **Cobalt Strike Beacon** for backdoor access and command execution, while becoming more selective and cautious in its tradecraft. The operation also uses **EXE-based loaders**, **scheduled tasks**, broader reconnaissance, and compromised infrastructure instead of dedicated servers; Check Point further linked the group to exploitation of the **GoAnywhere** pre-authentication command injection flaw, **`CVE-2023-0669`**, to compromise servers later used as command-and-control infrastructure.
Aug 15, 2026
Australia’s ACSC and CISA warned that Chinese state-sponsored actors compromised networks worldwide as part of a broad espionage operation that targeted IT service providers and then leveraged that access to reach downstream customer environments. U.S. government reporting tied the activity to Chinese cyber actors associated with the Ministry of State Security, describing a long-running campaign that stole intellectual property and sensitive data from organizations across at least 12 countries and sectors including information technology, energy, healthcare, communications, and critical manufacturing. The intrusions relied on stolen administrative credentials, abuse of digital certificates, and post-compromise tooling including **PowerShell**, **PowerSploit**, **REDLEAVES**, and **PLUGX** to maintain persistence and move laterally. Authorities said the malware used techniques such as **DLL side-loading**, in-memory execution, and **RC4**-encrypted command-and-control over port `443`, including spoofed domains masquerading as Windows update infrastructure, and urged defenders to strengthen privileged account protections, network segmentation, logging, and monitoring for suspicious administrative share activity and protocol mismatches.
Jun 29, 2026