Loading story…
ReliaQuest investigated an intrusion at an unnamed US defense technology company in February 2025, attributing it to a Chinese advanced persistent threat group with medium-high confidence. Attackers initially exploited SharePoint vulnerabilities and, 15 days after losing access, re-entered through vulnerable Ivanti Pulse Secure devices. They used compromised service accounts, SMB, chained web shells, and obfuscated in-memory execution to reach sensitive SFTP servers while disabling logging and concealing activity. Persistence included permanent WMI event consumers, modified Globalscape files, and suspected web shells on Ivanti appliances. ReliaQuest assessed the operation as likely espionage aimed at defense and engineering intellectual property, but did not establish successful data exfiltration.
Separately, Palo Alto Networks Unit 42 reported Operation Diplomatic Specter, an active Chinese cyberespionage campaign using a rare toolset against government entities in the Middle East, Africa, and Asia. The reports describe Chinese espionage targeting both government information and sensitive defense technology, without establishing a shared operator or campaign. For defenders, the defense-sector intrusion highlights the importance of patching internet-facing SharePoint and Ivanti systems, investigating compromised service accounts, and checking WMI persistence, Globalscape file integrity, and SFTP access. The attackers’ return through a different entry point also demonstrates why remediation must address alternative access paths rather than only the initial compromise.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
In February 2025, ReliaQuest investigated the intrusion against the unnamed US-based defense technology customer. The attackers targeted an SFTP server containing network configurations, system backups, and proprietary defense-contract information.
ReliaQuest attributed the intrusion to an unspecified Chinese advanced persistent threat group with medium-high confidence and assessed its likely objective as stealing defense and engineering intellectual property. The report did not establish that data was successfully exfiltrated.
Attackers injected malicious code into legitimate Globalscape EFT files while preserving their original functionality to disguise persistent access. A crafted POST request to "favidon.ico" on the SFTP server's public-facing webpage could activate the backdoor and bypass authentication.
Attackers disabled logging on Ivanti appliances and wiped logs described by the report as Active Directory driver logs on an Exchange server. These actions concealed activity and obscured authentication and user-access trails.
Attackers installed a permanent WMI event consumer that checked for host changes every five seconds and executed a VBScript payload, providing persistence across reboots.
Attackers used WMI to execute obfuscated scripts in memory and repeatedly attempted to load scripts designed to write data to "C:\ProgramData\Templates.log" on domain controllers and subsequently the SFTP server. They also injected code into the legitimate "lbfoAdmin.exe" binary, bypassing EDR and supporting operations on the SFTP server.
During the Ivanti-based intrusion, attackers remotely modified "redirsuiteserviceproxy.aspx," "logon.aspx," and "logoff.aspx" to deploy web shells. The shells communicated with a compromised Ivanti device for command and control and were chained to traverse network segments.
Fifteen days after losing access, attackers exploited unspecified vulnerabilities in multiple unpatched, end-of-life Ivanti Pulse Secure devices. They used residential proxy IP addresses to conceal their traffic sources.
The attackers lost access following their initial intrusion. The report does not specify when or how that access was interrupted.
Attackers began lateral movement 21 hours after initial access, using compromised accounts and an SMB named pipe called "ntsvcs" to obtain extensive file-access and execution permissions on an SCCM server and a domain controller. RDP attempts against 27 hosts failed.
Twenty hours after the SharePoint compromise, attackers used compromised service accounts to scan the network and identify sensitive SFTP servers in preparation for lateral movement.
Attackers exploited multiple unspecified SharePoint vulnerabilities to compromise a server at an unnamed US defense technology company. They then brute-forced service accounts associated with SharePoint and Varonis.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
reliaquest.com
Open sourceunit42.paloaltonetworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Australia’s ACSC and CISA warned that Chinese state-sponsored actors compromised networks worldwide as part of a broad espionage operation that targeted IT service providers and then leveraged that access to reach downstream customer environments. U.S. government reporting tied the activity to Chinese cyber actors associated with the Ministry of State Security, describing a long-running campaign that stole intellectual property and sensitive data from organizations across at least 12 countries and sectors including information technology, energy, healthcare, communications, and critical manufacturing. The intrusions relied on stolen administrative credentials, abuse of digital certificates, and post-compromise tooling including **PowerShell**, **PowerSploit**, **REDLEAVES**, and **PLUGX** to maintain persistence and move laterally. Authorities said the malware used techniques such as **DLL side-loading**, in-memory execution, and **RC4**-encrypted command-and-control over port `443`, including spoofed domains masquerading as Windows update infrastructure, and urged defenders to strengthen privileged account protections, network segmentation, logging, and monitoring for suspicious administrative share activity and protocol mismatches.
Jun 29, 2026
Chinese state-linked intrusion groups have continued broad cyberespionage operations against governments, critical infrastructure, telecommunications, finance, technology, and research organizations across Europe, Southeast Asia, Russia, the United States, and other regions. Public reporting from ENISA/CERT-EU, CISA, and private threat intelligence firms links multiple campaigns to clusters including **APT27**, **APT30**, **APT31**, **GALLIUM**, **Mustang Panda**, **APT41/RedGolf**, **TA459**, and **RedHotel**, with activity focused on information theft, persistent access, and in some cases economic espionage. Authorities and researchers said these actors repeatedly exploited exposed enterprise systems such as Microsoft Exchange, SharePoint, Zimbra, Pulse Connect Secure, Citrix ADC, F5 BIG-IP, VMware vCenter, Atlassian Confluence, and ManageEngine, while also using spear-phishing, EU-themed lures, and spoofed domains to gain entry.
Aug 15, 2026
SentinelLABS disrupted multiple China-nexus cyberespionage campaigns between June 2024 and March 2025 targeting SentinelOne, a South Asian government entity, a European media organization, and more than 70 other victims. The ShadowPad and PurpleHaze clusters used chained zero-days in edge appliances, including `CVE-2024-8963` and `CVE-2024-8190`, alongside ShadowPad malware protected by ScatterBrain/ScatterBee obfuscation, the Go-based GOREshell reverse-SSH backdoor, Nimbo-C2, operational relay box networks, and log removal. SentinelOne reported that it was not compromised. A joint Tenable-SentinelOne review shows that this activity reflects a broader cross-actor pattern: 93 CVE-to-actor attribution pairs across 82 vulnerabilities converged on all seven identified edge-device vendors, despite only 21% overlap in the CVEs tracked independently. Twelve flaws have confirmed exploitation by multiple China-, Russia-, DPRK-, or Iran-linked groups and ransomware operators. F5, Citrix, and Ivanti EPMM and Connect Secure deployments face recurring exposure and exploitation; organizations should prioritize edge-device patching, disable unnecessary features, continuously monitor remote-access systems, and use segmentation and other defense-in-depth controls to limit lateral movement after a breach.
Aug 26, 2026