Loading story…
SentinelLABS, Microsoft, and PwC reported that the Sandman APT is likely connected to suspected China-based threat clusters tied to the KEYPLUG backdoor, especially STORM-0866 and Red Dev 40. The assessment is based on multiple overlaps, including the presence of Sandman’s LuaDream malware alongside KEYPLUG in the same victim environments, shared targeting patterns in the Middle East and South Asia, and similar infrastructure practices such as hosting provider selection, reverse-proxy use, and domain naming conventions.
Researchers said LuaDream and KEYPLUG remain distinct malware families, but they share notable design traits, including modular architecture, multi-protocol command-and-control support, comparable execution flow, and overlapping data-handling structures. The findings point to either operational cooperation or shared tooling within the broader China-linked espionage ecosystem, and also indicate that Lua-based malware development is no longer limited to Western or Western-aligned operators but is increasingly being adopted by China-linked adversaries.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
SentinelLABS, Microsoft, and PwC assessed that Sandman APT is likely associated with suspected China-based threat clusters using the KEYPLUG backdoor, particularly STORM-0866/Red Dev 40. The assessment was based on cohabitation of LuaDream and KEYPLUG in the same victim environments, overlaps in victimology, shared infrastructure practices, and malware design similarities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SentinelLABS and QGroup GmbH identified a previously untracked threat cluster, **Sandman**, targeting telecommunications providers in the Middle East, Western Europe, and the South Asian subcontinent. The intrusion set used a modular backdoor called **LuaDream**, an unusual malware framework built on **LuaJIT**, and showed activity consistent with espionage-focused operations. Investigators said the actor stole administrative credentials, used **pass-the-hash** over **NTLM** to reach selected workstations, and moved laterally in a restrained manner designed to reduce the chance of detection. The attackers deployed LuaDream through **DLL hijacking**, planting a malicious `ualapi.dll` that was loaded by the Windows **Spooler** or **Fax** service. Researchers described LuaDream as a large, actively developed platform with dozens of components, plugin-based extensibility, and support for multiple command-and-control channels including **TCP**, **HTTPS**, **WebSocket**, and **QUIC**. SentinelLABS said it could not confidently tie Sandman to a known threat actor, but assessed that the combination of sophisticated tooling, infrastructure overlap across victims, and uneven operational tradecraft may point to a private contractor or mercenary-style group.
Jun 29, 2026
SentinelOne reported that the **Sandman** APT targeted telecommunications providers with a rare **LuaJIT-based** malware platform dubbed **DreamLand**, expanding on earlier reporting that linked the toolkit to an intrusion against a government entity in Pakistan. Researchers described DreamLand as a modular Windows malware family that relies on compiled Lua scripts rather than conventional native implants, an uncommon design choice that complicates reverse engineering and gives operators flexible post-compromise control. Technical analysis shows the infection chain using `libcurl.dll` to load `UpdateCheck.dll`, which then decrypts and decompresses an embedded LuaJIT orchestrator and executes additional compiled scripts stored in `updater.ver`. The malware includes anti-debugging features and uses Lua FFI to access Windows APIs directly, while configuration data points to HTTPS command-and-control over port `443` via `ssl.explorecell.com`. Researchers also identified a related loader, `Comx64.dll`, believed to come from the same developer and built to load shellcode from an encrypted local file, suggesting the toolkit remains under active development and may support future intrusions.
Aug 15, 2026
Palo Alto Networks Unit 42 reported that the **PKPLUG** intrusion set conducted long-running cyber espionage operations across Asia, particularly in Southeast Asia, and assessed with high confidence that the activity is tied to Chinese nation-state adversaries. The group was described as active for at least six years and focused on targets in **Myanmar, Taiwan, Vietnam, Indonesia, Mongolia, Tibet, and Xinjiang**, indicating intelligence collection against politically and geopolitically sensitive organizations and communities. The campaigns used a combination of public and custom malware, including **PlugX**, **Poison Ivy**, **Zupdax**, **9002**, **HenBox**, and the previously unknown Windows backdoor **Farseer**, with **DLL side-loading** and **spear-phishing** repeatedly used for delivery and execution. Unit 42 said overlapping infrastructure, malware characteristics, and shared tactics connected multiple previously reported operations under the PKPLUG umbrella, while **HenBox** expanded the threat to Android devices—especially targeting **Uyghurs** and **Xiaomi** devices—and the researchers released a **STIX 2.0** adversary playbook consolidating indicators, campaigns, and ATT&CK-mapped techniques.
Jun 29, 2026