Loading story…
Check Point Research reported that the Chinese espionage group Sharp Dragon—previously tracked as Sharp Panda—has expanded operations from earlier activity in Southeast Asia to target government organizations in Africa and the Caribbean. The campaign uses highly tailored phishing emails and weaponized documents to gain initial access, continuing a pattern of government-focused intrusion activity previously associated with the group.
Researchers said the actor has shifted from custom malware including VictoryDLL and the Soul framework to Cobalt Strike Beacon for backdoor access and command execution, while becoming more selective and cautious in its tradecraft. The operation also uses EXE-based loaders, scheduled tasks, broader reconnaissance, and compromised infrastructure instead of dedicated servers; Check Point further linked the group to exploitation of the GoAnywhere pre-authentication command injection flaw, CVE-2023-0669, to compromise servers later used as command-and-control infrastructure.
TTPs, infrastructure, and targeting history in one profile.
4 events from the most recent confirmed update back to the earliest known activity.
In the campaign described by Check Point, Sharp Dragon moved away from custom malware such as VictoryDLL and the Soul framework and instead deployed Cobalt Strike Beacon for backdoor access and command execution. Researchers also observed broader reconnaissance, EXE-based loaders, and persistence via scheduled tasks.
Check Point Research reported an ongoing cyber espionage campaign attributed to Sharp Dragon targeting governmental organizations in Africa and the Caribbean. The campaign used highly tailored phishing emails, compromised trusted government entities, and weaponized documents to gain footholds in new territories.
Check Point Research published findings on a Chinese APT group it called SharpPanda targeting a Southeast Asian government and using a previously unknown backdoor. This establishes earlier activity by the actor later referred to as Sharp Dragon.
Check Point said Sharp Dragon exploited the GoAnywhere pre-authentication command injection vulnerability CVE-2023-0669 to compromise servers that were later used as command-and-control infrastructure. The actor also shifted from dedicated servers to compromised infrastructure.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
blog.checkpoint.com
Open sourceresearch.checkpoint.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Silver Dragon**, an emerging China-linked threat actor assessed as part of the **APT41** ecosystem, has conducted cyberespionage operations against **government entities in Europe and Southeast Asia** since at least mid-2024. Reporting based on Check Point research says the group gains initial access through a mix of **exploitation of public-facing servers** and **phishing emails with malicious attachments**, then blends into normal activity by **hijacking legitimate Windows services** for persistence and command-and-control (C2). The activity includes a toolchain that uses **heavily obfuscated loaders** (including **MonikerLoader** and **BamboLoader**) to decrypt and inject payloads in memory, with **Cobalt Strike** beacons commonly deployed as a final-stage payload. Check Point also observed **Google Drive-based C2** as an evasion technique, alongside Cobalt Strike configurations that can use **DNS tunneling**, **HTTP via Cloudflare**, or **SMB** for internal communications; additional custom post-exploitation tooling (e.g., screenshot capture utilities) was also reported, and artifacts suggested an **automated framework** for generating per-target attack packages (e.g., consistent file timestamps and recovered configuration logs with paths, service names, keys, and injected processes).
Jun 29, 2026
The **DragonOK** espionage group was linked to a renewed wave of targeted intrusions against organizations in Japan and other parts of Asia, using updated malware families including **PlugX** variants, **Sysget**, **IsSpace**, and **TidePool**. Researchers tied a PlugX variant known as **PIPX** to DragonOK through overlapping command-and-control infrastructure, domain registration patterns, and tradecraft previously associated with the group. The activity primarily targeted manufacturing and high-tech organizations in Japan and Taiwan, while related reporting also identified likely victims in Tibet and Russia. The attacks used phishing emails, malicious executables, and weaponized RTF documents exploiting **`CVE-2015-1641`**, alongside techniques such as **DLL sideloading**, code injection into **`nslookup.exe`**, and persistence through services, autorun registry keys, and PowerShell-based registry changes. DragonOK’s newer tooling showed stronger encryption, anti-debugging and anti-VM protections, altered command-and-control communications, and an unusual method of storing encrypted payloads in registry values such as **`HKLM\SOFTWARE\BINARY`** or **`HKCU\SOFTWARE\BINARY`** instead of loading directly from disk. The combined reporting indicates the group was actively refining its malware and broadening operations while maintaining a strong focus on Japanese targets.
Aug 15, 2026
A large-scale cyberespionage operation tracked as **TGR-STA-1030** (also **UNC6619**) has been reported compromising government and critical-infrastructure organizations across **37 countries**, with broader reconnaissance activity against government infrastructure in **155 countries**. The operation—described as “**Shadow Campaigns**”—uses **phishing** (often impersonating government entities) and **N-day vulnerability exploitation** across multiple enterprise and edge products (including **SAP**, **Microsoft Exchange**, and **D-Link**) to gain initial access, then deploys tooling for persistence, lateral movement, and stealth. Post-compromise activity includes deployment of **Diaoyu Loader** to stage frameworks and remote admin tooling such as **Cobalt Strike** and **VShell**, plus web shells and tunneling utilities. A notable capability is **ShadowGuard**, a **Linux eBPF rootkit** used for kernel-level stealth. Reporting also indicates Palo Alto Networks’ Unit 42 assessed the actor as **state-aligned and operating out of Asia**, citing indicators such as tooling, language preferences, activity patterns aligned to **GMT+8**, and infrastructure linkages; separate reporting claims Unit 42 initially connected the campaign more directly to **China** but softened public attribution due to concerns about potential retaliation following Chinese restrictions on certain foreign cybersecurity vendors’ software.
Jul 12, 2026