CL-STA-1087 Southeast Asian military intelligence-collection campaign
Campaign
Summary
Hide ▲
Show ▼
A suspected China-based espionage operation tracked as CL-STA-1087 is targeting Southeast Asian military organizations, creating a sustained intelligence-collection risk that has persisted since at least 2020. The operation matters because it focuses on highly specific military files and uses covert access techniques to keep long-term footholds. Researchers linked the cluster to Pastebin- and Dropbox-based command handling, underscoring a disciplined operator setup. The intrusion chain includes PowerShell, reverse shells, and DLL hijacking to support persistence and stealth.
Related Happenings
ModeloRAT malicious PowerShell and Dropbox delivery activity
Malware Activity
First: 14.05.2026 15:12
Last: 14.05.2026 15:12
Sources 1
About this happening:
The **ModeloRAT** activity now uses a **malicious PowerShell command** and a **Dropbox ZIP payload** to gain persistent footholds, enabling **system reconnaissance**, **screenshot...
ModeloRAT malicious PowerShell and Dropbox delivery activity
Malware ActivityAbout this happening: The **ModeloRAT** activity now uses a **malicious PowerShell command** and a **Dropbox ZIP payload** to gain persistent footholds, enabling **system reconnaissance**, **screenshot...
SHADOW-EARTH-053 China-aligned espionage campaign against Asian government and defense targets
Campaign
First: 01.05.2026 17:02
Last: 01.05.2026 17:02
Sources 1
About this happening:
**SHADOW-EARTH-053** is running an active **China-aligned espionage campaign** against **government and defense** targets across **South, East, and Southeast Asia** and **Poland**...
SHADOW-EARTH-053 China-aligned espionage campaign against Asian government and defense targets
CampaignAbout this happening: **SHADOW-EARTH-053** is running an active **China-aligned espionage campaign** against **government and defense** targets across **South, East, and Southeast Asia** and **Poland**...
CL-UNK-1068 Asia critical-infrastructure cyberespionage campaign
Campaign
First: 09.03.2026 14:05
Last: 09.03.2026 14:05
Sources 1
About this happening:
The **CL-UNK-1068** espionage campaign is active across **Asia**, putting **aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications** or...
CL-UNK-1068 Asia critical-infrastructure cyberespionage campaign
CampaignAbout this happening: The **CL-UNK-1068** espionage campaign is active across **Asia**, putting **aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications** or...
CL-UNK-1068 years-long espionage campaign targeting Asian organizations
Campaign
First: 09.03.2026 09:21
Last: 09.03.2026 09:21
Sources 1
About this happening:
A **Chinese threat actor** is linked to a **years-long espionage campaign** against **high-value organizations in South, Southeast, and East Asia**, creating persistent risk for c...
CL-UNK-1068 years-long espionage campaign targeting Asian organizations
CampaignAbout this happening: A **Chinese threat actor** is linked to a **years-long espionage campaign** against **high-value organizations in South, Southeast, and East Asia**, creating persistent risk for c...
TGR-STA-1030/UNC6619 Shadow Campaigns espionage operation
Campaign
First: 07.02.2026 17:09
Last: 07.02.2026 17:09
Sources 1
About this happening:
The **TGR-STA-1030/UNC6619** operation **Shadow Campaigns** expanded a state-sponsored espionage effort that compromised **at least 70 organizations** across **37 countries**, inc...
TGR-STA-1030/UNC6619 Shadow Campaigns espionage operation
CampaignAbout this happening: The **TGR-STA-1030/UNC6619** operation **Shadow Campaigns** expanded a state-sponsored espionage effort that compromised **at least 70 organizations** across **37 countries**, inc...
Timeline
-
13.03.2026 19:33 2 articles · 2mo ago
Unit 42 discloses CL-STA-1087 campaign against Southeast Asian military organizations
Initial DisclosurePalo Alto Networks Unit 42 disclosed a suspected China-based cyber espionage campaign, tracked as CL-STA-1087, targeting Southeast Asian military organizations and focused on highly specific military intelligence collection rather than bulk theft. The reported activity included suspicious PowerShell execution followed by reverse shells to a threat actor-controlled C2 server, with tooling that included the AppleChris and MemFun backdoors and the Getpass credential harvester. Researchers also described Pastebin- and Dropbox-based C2 resolution, DLL hijacking, process hollowing, sandbox evasion, and collection of files related to military capabilities, organizational structures, and C4I systems.
Show sources
- Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware — thehackernews.com — 13.03.2026 19:33
- Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware — thehackernews.com — 13.03.2026 19:33