Loading story…
Chinese state-backed threat actors, believed to be APT41, have impersonated US Rep. John Moolenaar in spear-phishing attacks targeting US government agencies, trade groups, law firms, and think tanks. The campaign aimed to steal sensitive data and gain persistent access by distributing malware through emails disguised as official communications about US–China sanctions. The attacks leveraged cloud services and developer tools to evade detection and exfiltrate data, with the ultimate goal of influencing US policy deliberations and trade negotiations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
5 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcego.theregister.com
Open sourcethehackernews.com
Open sourcedarkreading.com
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
China-aligned espionage actor **TA419** targeted U.S. artificial-intelligence policy experts at think tanks, universities, and law firms with credential-phishing campaigns focused on AI governance, export controls, supply chains, and military AI. Beginning July 8, the operators impersonated former White House technology official Lynne Edwards Parker and former State Department chief economist Heidi Crebo-Rediker, using fabricated policy invitations to establish contact. A related February operation impersonated a senior Anthropic employee and sought feedback on military integration of Claude. After recipients responded, TA419 directed them through URL shorteners and actor-controlled infrastructure to fraudulent OneDrive pages using a customized **Frameless BitB** adversary-in-the-middle kit. The phishing flow relayed genuine Microsoft 365/Entra ID authentication, including MFA and conditional-access prompts, and aimed to steal authenticated session cookies as well as credentials. Proofpoint assessed the activity as Chinese intelligence collection against U.S. AI-policy and national-security deliberations; it did not determine how many people were targeted, whether accounts were compromised, or whether data was taken. The campaign coincides with intensifying U.S.-China competition over frontier AI, semiconductor controls, open-source models, and military and industrial AI capabilities.
Oct 2, 2026Chinese threat actors are leveraging shifts in U.S.-China policy to conduct espionage campaigns. These operations are characterized by stealth and advanced tactics. The activity highlights the ongoing cyber risk posed by state-sponsored Chinese groups.
Jun 29, 2026
Chinese state-linked intrusion groups have continued broad cyberespionage operations against governments, critical infrastructure, telecommunications, finance, technology, and research organizations across Europe, Southeast Asia, Russia, the United States, and other regions. Public reporting from ENISA/CERT-EU, CISA, and private threat intelligence firms links multiple campaigns to clusters including **APT27**, **APT30**, **APT31**, **GALLIUM**, **Mustang Panda**, **APT41/RedGolf**, **TA459**, and **RedHotel**, with activity focused on information theft, persistent access, and in some cases economic espionage. Authorities and researchers said these actors repeatedly exploited exposed enterprise systems such as Microsoft Exchange, SharePoint, Zimbra, Pulse Connect Secure, Citrix ADC, F5 BIG-IP, VMware vCenter, Atlassian Confluence, and ManageEngine, while also using spear-phishing, EU-themed lures, and spoofed domains to gain entry.
Aug 15, 2026