CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
Summary: Unit 42 Palo Alto Networks tracked a cluster it calls CL-STA-0048 targeting high-value South Asian organizations, including a telecommunications company, and assessed with moderate-high confidence that the activity originates in China. The actor moved through failed IIS and Apache ColdFusion web shell attempts before compromising an unpatched internet-facing MSSQL server, then used Hex Staging, DNS exfiltration via ping, the PlugX backdoor, Cobalt Strike, and the SQLcmd utility to steal data.
Why it matters: The operation's stated objectives were the personal information of government employees and sensitive organizational data, and it succeeded only after two blocked attempts - meaning a single unpatched internet-facing MSSQL server was the difference between containment and a nation-state intrusion.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026