Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Chinese-speaking threat actor Central Asia government campaign

Campaign
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

The Chinese-speaking threat actor is running an active campaign against government organizations in Central Asia and Syria, expanding risk across multiple public-sector sectors and using OctLurk, SilkLurk, and LurkProxy to maintain access and steal credentials. The activity has been observed since January 2025, indicating a sustained intrusion thread rather than a one-off event.

Related Happenings

PhantomCore TrueConf server targeting campaign in Russia

Campaign
H score34 First: 27.04.2026 14:54 Last: 27.04.2026 14:54 Sources 1

About this happening: Head Mare is exploiting unpatched TrueConf Server flaws to replace TrueConf Client installer updates with trojanized builds that deliver PhantomCore and PhantomG...

Latest development: 08.08.2026 17:16

Head Mare is exploiting unpatched TrueConf Server flaws to replace legitimate TrueConf Client installers with trojanized updates that deliver PhantomCore and PhantomGraph backdoors, using a web shell for persistent access and targeting Russian organizations across instrumentation, electronics, transportation, energy, IT, and software development sectors.

Open Happening

Timeline

  1. 31.07.2026 21:52 2 articles · 13d ago

    Chinese-speaking threat actor Central Asia government campaign

    Initial Disclosure

    The earliest visible phase is a fresh wave of attacks against government organizations in Central Asia and Syria that began in January 2025. Initial operations already use custom backdoors and network proxying to establish footholds and support follow-on access.

    Show sources
    Open in new tab