Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia

Summary: Unit 42 identified a cluster of malicious activity, designated CL-STA-1087 and suspected with moderate confidence to be operating out of China, targeting Southeast Asian military organizations since at least 2020. The campaign used newly discovered AppleChris and MemFun backdoors and a custom Getpass credential harvester, with attackers searching for files on military capabilities, organizational structures, and collaboration with Western armed forces. The investigation began after Cortex XDR agents detected suspicious PowerShell activity, revealing persistence on an unmanaged endpoint and reverse shells to four command and control servers.

What's compelling: The attackers maintained a dormant foothold for several months before resuming operations, and the initial infection vector remains undetermined - meaning the entry point into these military networks is still unknown. The targeting of C4I systems and files on collaboration with Western armed forces signals intelligence collection aimed at military command and control, not opportunistic theft.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026