Threats · 182 days ago

China-Linked Hackers Maintain Years-Long Access to Southeast Asian Militaries

Palo Alto Unit 42 attributes a years-long espionage campaign to China-linked CL-STA-1087 that maintained access to Southeast Asian military networks since at least 2020. The group harvested targeted files on military capabilities and C4I and used custom backdoors (AppleChris, MemFun), a Getpass credential stealer, PowerShell, WMI-based lateral movement, and DLL hijacking to persist.

Timeline

• Mar 17 Reported by Dark Reading
• Mar 16 Reported by SecurityWeek

Sources

2 sources covering this story

• Dark Reading Mar 17

  Chinese Hackers Owned Southeast Asian Military Orgs for Years

  Researchers uncovered an extensive cyber espionage campaign that used novel backdoors and familiar evasion techniques to maintain persistent access.

• SecurityWeek Mar 16

  China-Linked Hackers Hit Asian Militaries in Patient Espionage Operation

  The state-sponsored hackers deployed custom tools and stayed dormant in the compromised environments for months.

Entities

• CL-STA-1087

Part of the PlainSec briefing for 2026-03-17

Editions

• Briefing for 2026-03-17

Related stories

• Boggy Serpens Escalates Attacks on Maritime and Energy
• Stolen GitHub Tokens Inject Malware into Python Repositories