China-Linked Espionage Campaign Compromises Southeast Asian Edge Routers

Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called router.elf. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying iptables NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows.

The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, client_rc_start, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious version.dll loaded by CrashReport.exe. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a zh-CN setting, and tooling overlaps with earlier China-linked operations.