Loading story…
Palo Alto Networks Unit 42 reported that the Chinese espionage group Alloy Taurus deployed a new Linux variant of PingPull alongside a related backdoor, Sword2033, extending a malware family previously associated with Windows intrusions. The Linux PingPull sample, uploaded to VirusTotal in March 2023, communicated over HTTPS with yrhsywu2009.zapto[.]org on port 8443 and reused the same AES key and command structure seen in earlier PingPull activity, strengthening the link to the group.
Unit 42 also tied Sword2033 samples to overlapping infrastructure, including a sample configured to connect to 196.216.136[.]139 in South Africa, and connected the activity to earlier Alloy Taurus indicators such as 45.251.241[.]82. The infrastructure included a domain impersonating South African military branding, while sustained connections from an IP linked to an organization financing long-term urban infrastructure projects in Nepal suggested recent espionage activity targeting entities in South Africa and Nepal.
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
A Linux PingPull sample named nztloader was uploaded to VirusTotal on March 7, 2023. Unit 42 identified it as a new Linux variant communicating over HTTPS with yrhsywu2009.zapto[.]org on port 8443.
Unit 42 reported that the domain yrhsywu2009.zapto[.]org was most recently hosted on 5.181.25[.]99 until early February 2023. This domain was later tied to both PingPull and Sword2033 samples.
The IP address 196.216.136[.]139 resolved to vpn729380678.softether[.]net from late December 2022 through mid-February 2023. Unit 42 also linked this infrastructure to a South Africa-themed impersonation domain pattern.
A second Sword2033 sample named Hopke was observed in July 2022. It was configured to connect to 196.216.136[.]139 for command and control.
In June 2022, Unit 42 published earlier research on PingPull and attributed the tool to Alloy Taurus. The later Linux and Sword2033 findings were linked back to this prior reporting.
The domain yrhsywu2009.zapto[.]org resolved to 45.251.241[.]82 for one day in April 2022. Unit 42 had previously listed that IP as an active indicator of compromise tied to Alloy Taurus.
Unit 42 reported that PingPull samples date back to September 2021, establishing the malware family's earlier use by Alloy Taurus. This predates later public reporting and newer platform variants.
Unit 42 assessed that Alloy Taurus, also known as GALLIUM and Softcell, has operated since at least 2012. The group has historically targeted telecommunications companies across Asia, Europe, and Africa.
Unit 42 reported that Alloy Taurus was using a new Linux variant of PingPull and a related backdoor called Sword2033. The report tied both malware families to shared infrastructure and noted recent activity affecting organizations in South Africa and Nepal.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed multiple China-aligned intrusion sets using modular tooling to compromise targets across Windows, web, and mobile environments. ESET said **TheWizards** used a tool called **Spellbinder** to abuse IPv6 `SLAAC` by sending rogue `ICMPv6 Router Advertisements`, positioning the attackers as the default gateway for adversary-in-the-middle operations. The group then intercepted DNS requests for Chinese software vendors and redirected update traffic so legitimate applications such as **Tencent QQ** and previously **Sogou Pinyin** fetched malicious payloads instead of real updates. The resulting infection chain used a downloader DLL, an encrypted blob, and in-memory loading of the **WizardNet** backdoor, which patched `AMSI` and `ETW`, supported modular execution, and injected shellcode into other processes while maintaining encrypted command-and-control. Separate reporting described broader China-linked operations using flexible malware delivery and post-compromise frameworks. Trend Micro tied **Earth Minotaur** to the **MOONSHINE Exploit Kit** and the **DarkNimbus** Android backdoor, while TrendAI documented **PeckBirdy**, a JScript-based framework used since 2023 across browsers, `MSHTA`, `WScript`, Classic ASP, Node.js, and `.NET ScriptControl` for watering-hole attacks, credential theft, lateral movement, reverse shells, and persistent backdoor access. PeckBirdy was observed in campaigns against Chinese gambling sites, Asian government entities, and private organizations, alongside modular backdoors **HOLODONUT** and **MKDOOR**. The reporting also noted infrastructure and tooling overlaps linking some of these activities to **UNC3569**, **Earth Baxia**, and supplier **UPSEC**, underscoring an ecosystem of China-aligned operators reusing shared malware, hijacking infrastructure, and fake software-update lures.
Aug 21, 2026
Palo Alto Networks Unit 42 reported that the **PKPLUG** intrusion set conducted long-running cyber espionage operations across Asia, particularly in Southeast Asia, and assessed with high confidence that the activity is tied to Chinese nation-state adversaries. The group was described as active for at least six years and focused on targets in **Myanmar, Taiwan, Vietnam, Indonesia, Mongolia, Tibet, and Xinjiang**, indicating intelligence collection against politically and geopolitically sensitive organizations and communities. The campaigns used a combination of public and custom malware, including **PlugX**, **Poison Ivy**, **Zupdax**, **9002**, **HenBox**, and the previously unknown Windows backdoor **Farseer**, with **DLL side-loading** and **spear-phishing** repeatedly used for delivery and execution. Unit 42 said overlapping infrastructure, malware characteristics, and shared tactics connected multiple previously reported operations under the PKPLUG umbrella, while **HenBox** expanded the threat to Android devices—especially targeting **Uyghurs** and **Xiaomi** devices—and the researchers released a **STIX 2.0** adversary playbook consolidating indicators, campaigns, and ATT&CK-mapped techniques.
Jun 29, 2026
Reporting across multiple research teams described a surge of distinct, ongoing intrusion campaigns rather than a single unified incident. **Check Point** reported on **Silver Dragon**, a Chinese-aligned activity cluster assessed as operating under the broader **APT41** umbrella, targeting organizations in **Southeast Asia and Europe** (notably government) via exploitation of public-facing servers and phishing, then deploying **Cobalt Strike**, **DNS tunneling**, and a new Google Drive–based backdoor (**GearDoor**) alongside custom tools (**SSHcmd** and **SliverScreen**) for remote access and screen capture. **Microsoft** detailed separate February 2026 phishing campaigns by an unknown actor that used meeting/invoice-style lures and **EV code-signed** malware (certificate issued to **TrustConnect Software PTY LTD**) masquerading as common workplace apps (e.g., `msteams.exe`, `adobereader.exe`, `zoomworkspace.clientsetup.exe`) to install legitimate **RMM** tooling (**ScreenConnect**, **Tactical RMM**, **Mesh Agent**) for persistent access and lateral movement. Other reporting highlighted additional, unrelated campaigns and tradecraft: **ClearSky** described a Russian-aligned operation targeting **Ukraine** using a phishing-delivered ZIP/HTA chain that drops a .NET loader (**BadPaw**) and backdoor (**MeowMeow**) with **.NET Reactor** obfuscation, parameter-gated execution, and sandbox/tooling checks (with low-confidence linkage to **APT28**). **Cofense**-reported activity (via SC Media) showed phishing that weaponizes **Windows File Explorer + WebDAV** using URL/LNK shortcuts to pull payloads (notably **AsyncRAT**, **XWorm**, **DcRAT**) and infrastructure including **Cloudflare Tunnel** domains hosting WebDAV servers. **Cisco Talos**-reported **Dohdoor** activity (UAT-10027) targeted US **education and healthcare**, using PowerShell→batch→DLL sideloading via legitimate executables (e.g., `Fondue.exe`, `mblctr.exe`, `ScreenClippingHost.exe`) and **DNS-over-HTTPS** to Cloudflare for C2 discovery and tunneling. Separately, **Zscaler** reported **ScarCruft**’s *Ruby Jumper* campaign using **Zoho WorkDrive** for C2 and removable media components to reach air-gapped systems, while another Zscaler report analyzed **Dust Specter** targeting Iraqi government officials with password-protected RAR delivery and modular implants. **Qianxin XLab** assessed sanctioned infrastructure provider **Funnull** resurfacing to support scam/criminal supply chains and potential **MacCMS**-related supply-chain activity, and **F5 Labs** summarized **APT42**’s **TAMECAT** PowerShell backdoor focused on Edge/Chrome credential theft with C2 over Telegram/Discord/HTTPS and specific file/hash indicators. (A separate Help Net Security item on a Microsoft Defender onboarding tool is product/administrative news and not part of the threat-campaign reporting.)
Jun 29, 2026