A recently uncovered cyber-espionage campaign has been targeting high-profile organizations in Southeast Asia since October 2023, with suspected China-linked hackers believed to be responsible.
The campaign primarily aims to collect intelligence and has targeted government ministries, an air traffic control organization, a telecom company, and a media outlet.
Attackers use a mix of open-source and living-off-the-land tools, including a remote access tool that exploits Impacket and various malicious software associated with Chinese APT groups.
The attackers maintain persistent access to compromised networks, gathering passwords and exfiltrating valuable data.