CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

China-aligned clusters conduct coordinated Southeast Asian government intrusion campaign with multi-stage malware toolkits

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

A coordinated cyber operation attributed to three China-linked clusters targeted a Southeast Asian government organization between March and September 2025. The campaign deployed a suite of malware families including HIUPAN (USBFect), PUBLOAD, EggStremeFuel/Loader, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis Loader, and FluffyGh0st via complex infection chains. The activity indicates persistent access was the primary objective, leveraging overlapping TTPs across Mustang Panda (June–August), CL-STA-1048 (March–September, overlapping Earth Estries/Crimson Palace), and CL-STA-1049 (April & August, overlapping Unfading Sea Haze).

Timeline

  1. 30.03.2026 10:00 1 articles · 3h ago

    China-linked clusters launch multi-cluster intrusion against Southeast Asian government using staged malware toolkits (2025)

    Between March and September 2025, Mustang Panda, CL-STA-1048, and CL-STA-1049 conducted a coordinated intrusion campaign against a Southeast Asian government organization. Mustang Panda (June–August) used HIUPAN and Claimloader to deliver PUBLOAD and COOLCLIENT backdoors. CL-STA-1048 deployed EggStremeFuel/Loader, MASOL RAT, PoshRAT, and TrackBak Stealer during March–September overlaps with Earth Estries and Crimson Palace clusters. CL-STA-1049 leveraged Hypnosis Loader for DLL side-loading to install FluffyGh0st RAT in April and August. TTPs indicate shared objectives focused on long-term persistence and strategic intelligence collection.

    Show sources
    Open in new tab

Information Snippets