Tag: chinese apt

4 Attack Reports | 0 Vulnerabilities

Attack reports

APT Targets Azerbaijani Oil and Gas Industry

A sophisticated multi-wave intrusion campaign targeted an Azerbaijani oil and gas company from late December 2025 through late February 2026, attributed with moderate-to-high confidence to the Chinese APT group FamousSparrow. The operation exploited unpatched Microsoft Exchange servers via ProxyShe…
dll sideloading
chinese apt
energy sector
azerbaijan
deed rat
terndoor
2026-05-20
earth estries
exchange exploitation
famoussparrow
Published: May 20, 2026
Linked vulnerabilities : CVE-2021-34473, CVE-2021-31207, CVE-2021-34523, CVE-2022-41082, CVE-2022-41040
Downloadable IOCs: 2

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and mili…
espionage
plugx
government
africa
gh0st rat
telecommunications
china chopper
middle east
chinese apt
asia
iis backdoor
2025-09-30
ntospy
specter
iiservercore
assemblyexecuter
net-star
database targeting
Published: September 30, 2025
Downloadable IOCs: 4

How a new PlugX variant abuses DLL search order hijacking

A new campaign targeting telecommunications and manufacturing sectors in Central and South Asian countries has been discovered, delivering a new variant of PlugX. The campaign, active since 2022, shows overlaps between RainyDay and Turian backdoors, including the abuse of legitimate applications fo…
apt
plugx
rainyday
telecommunications
dll hijacking
manufacturing
chinese apt
2025-09-23
backdoordiplomacy
naikon
turian
2025-09-25
Published: September 25, 2025
Downloadable IOCs: 53

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

Earth Estries, a Chinese APT group, has been aggressively targeting critical sectors globally since 2023. The group employs advanced techniques and multiple backdoors, including GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, to compromise organizations in telecommunications, government, and other industrie…
government
telecommunications
demodex
crowdoor
2024-12-03
chinese apt
masol rat
sparrowdoor
snappybee
Published: December 3, 2024
Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-26855, CVE-2023-48788, CVE-2022-3236, CVE-2021-26858, CVE-2021-26857, CVE-2021-27065
Downloadable IOCs: 57
Click here to see more Attack Reports