Loading story…
Recorded Future reported that China’s People’s Liberation Army Unit 61419 purchased foreign antivirus products, indicating the unit was likely acquiring commercial security software to study, test, and potentially exploit it. The finding links a known PLA cyber element to procurement activity involving defensive tools made by overseas vendors, a pattern consistent with vulnerability research and offensive cyber preparation.
The report suggests the antivirus purchases were not routine enterprise acquisitions but part of a broader effort to analyze how widely deployed security products operate and where they may be weak. For defenders, the activity underscores the risk that endpoint protection platforms themselves can become high-value targets, especially when state-backed operators seek to identify exploitable flaws, bypass detection, or repurpose trusted software in intrusion campaigns.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Recorded Future published research assessing that China's PLA Unit 61419 had purchased foreign antivirus products, likely to study or exploit them. The reference does not provide a more specific underlying event date, so the publication date is used.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China’s Military Procurement Network suspended or banned several prominent domestic cybersecurity companies from PLA-related contracts in the first half of 2026 over alleged procurement violations, with collusive bidding cited as a central concern. Companies named in reporting include **TopSec**, **Venustech**, and subsidiaries of **Qi An Xin**, all of which are described as significant players in China’s cybersecurity sector and part of the broader ecosystem that has supported government and military cyber activity. The action has drawn added scrutiny because it follows earlier reporting on leaked **i-SOON** documents that allegedly detailed bid-rigging and coordinated bidding practices among Chinese cybersecurity vendors competing for state contracts. The measures suggest tighter military procurement oversight in China and could disrupt firms with close links to state security work, while exposing governance and compliance risks inside a sector long intertwined with official cyber operations.
Jul 16, 2026
Palo Alto Networks Unit 42 reported that the **PKPLUG** intrusion set conducted long-running cyber espionage operations across Asia, particularly in Southeast Asia, and assessed with high confidence that the activity is tied to Chinese nation-state adversaries. The group was described as active for at least six years and focused on targets in **Myanmar, Taiwan, Vietnam, Indonesia, Mongolia, Tibet, and Xinjiang**, indicating intelligence collection against politically and geopolitically sensitive organizations and communities. The campaigns used a combination of public and custom malware, including **PlugX**, **Poison Ivy**, **Zupdax**, **9002**, **HenBox**, and the previously unknown Windows backdoor **Farseer**, with **DLL side-loading** and **spear-phishing** repeatedly used for delivery and execution. Unit 42 said overlapping infrastructure, malware characteristics, and shared tactics connected multiple previously reported operations under the PKPLUG umbrella, while **HenBox** expanded the threat to Android devices—especially targeting **Uyghurs** and **Xiaomi** devices—and the researchers released a **STIX 2.0** adversary playbook consolidating indicators, campaigns, and ATT&CK-mapped techniques.
Jun 29, 2026
Palo Alto Networks Unit 42 reported a **previously undocumented Chinese threat actor**, tracked as **CL-UNK-1068**, conducting a multi-year intrusion campaign (observed since at least 2020) against high-value organizations across **South, Southeast, and East Asia**. Targeted sectors include **aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications**, with Unit 42 assessing **moderate-to-high confidence** that the primary objective is **cyber espionage** (while not fully ruling out criminal motives). The assessment cites tool provenance, linguistic artifacts in configurations, and consistent long-term targeting of Asian critical infrastructure as key factors supporting attribution. The activity features exploitation of **internet-facing web servers** to deploy **web shells** and establish persistence across both Windows and Linux environments, using a mix of custom malware, modified open-source tools, and **living-off-the-land binaries (LOLBINs)**. Reported tooling includes **Godzilla** and **ANTSWORD** web shells, the **Xnote** Linux backdoor, and **Fast Reverse Proxy (FRP)** for tunneling/relay; post-compromise behavior includes lateral movement and targeted file theft from Windows web servers (e.g., `c:\inetpub\wwwroot`) focusing on files such as `web.config`, `.aspx`, `.asmx`, `.asax`, and `.dll`, consistent with credential access and follow-on exploitation discovery.
Jun 29, 2026