China-Linked Cyber Espionage Targets Southeast Asian Military Organizations

A cyber espionage campaign, designated CL-STA-1087, has been targeting military organizations in Southeast Asia since at least 2020. Researchers at Unit 42 attribute this activity to a China-based state-sponsored group. The attackers have demonstrated strategic patience, maintaining dormant access for extended periods before resuming operations.

The campaign employs custom-developed tools, including the AppleChris and MemFun backdoors, as well as a credential harvester named Getpass. These tools facilitate intelligence collection on military capabilities, organizational structures, and collaborations with Western armed forces.

The attackers utilize advanced techniques such as Dead Drop Resolvers (DDR) to dynamically resolve command and control (C2) server addresses, enhancing operational security and evading detection. Infrastructure analysis indicates the use of China-based cloud services for C2 servers, with login pages written in Simplified Chinese.

Unit 42 advises organizations to implement robust security measures, including regular patching of vulnerabilities and monitoring for indicators of compromise, to defend against such advanced persistent threats.