China-aligned Clusters Built Redundant Persistence in Government Network
Three China-aligned activity clusters breached a Southeast Asian government network in 2025 to establish long-term espionage access. They ran overlapping campaigns and used multiple malware toolchains, including a USB-based HIUPAN loader that delivered the PUBLOAD backdoor and a long-running COOLCLIENT implant. Unit 42 says the overlapping tactics create redundant persistence that makes detection and cleanup harder; most private organizations face low direct risk.