Chinese Hackers Target Southeast Asian Militaries with Advanced Malware

A state-sponsored cyber espionage campaign from China has been detected targeting military organizations in Southeast Asia using sophisticated malware.

Key Points:

• The campaign, tracked as CL-STA-1087, has been active since at least 2020.
• Attackers employ backdoors named AppleChris and MemFun, alongside a credential harvester called Getpass.
• Focus is on gathering specific intelligence about military capabilities and structures, not bulk data theft.
• Employs advanced techniques to maintain persistence and evade detection, such as DLL hijacking and sandbox evasion.
• Infects systems via a highly strategic operational approach, demonstrating patience and precision.

A suspected China-based cyber espionage operation has been targeting military organizations in Southeast Asia as part of a long-standing state-sponsored campaign. Known by the moniker CL-STA-1087, the threat activity, as reported by Palo Alto Networks Unit 42, has been active since at least 2020 and involves sophisticated malware tools aimed at highly targeted intelligence collection rather than wide-scale data theft. Attackers have shown interest in collecting intelligence on military capabilities, organizational structures, and collaboration with Western armed forces, reflecting a strategic focus on sensitive military information.

The primary malware tools utilized include AppleChris and MemFun, both of which exhibit advanced characteristics typical of advanced persistent threat (APT) operations. For example, AppleChris employs DLL hijacking to execute commands, while MemFun operates as a modular platform that retrieves its payloads from a command-and-control server, enabling rapid deployment of new threats without altering the underlying malware. The infection processes have also been designed to evade detection techniques, with mechanisms like delayed execution and stealthy behavior to achieve persistent unauthorized access to compromised systems. This highlights the attackers' comprehensive understanding of operational security measures, allowing them to maintain clandestine access and focus on precision intelligence collection over extended periods.

What measures can Southeast Asian militaries take to protect against such targeted cyber espionage threats?

Learn More: The Hacker News

Want to stay updated on the latest cyber threats?

👉 [Subscribe to r/PwnHub](https://www.reddit.com/r/pwnhub)