FlagThis

← All Threat Actors
Threat Actor Profile

CL-STA-1087

No known aliases in database
▲ High Threat
Southeast Asian Military Espionage Campaign
Origin China
Sponsor China (State-sponsored)
Motivation Strategic espionage and intelligence collection focused on military capabilities, organizational structures, and defense collaborations with Western armed forces.

Target Sectors

Southeast Asian military organizations Regional defense and governmental entities

Known TTPs

AppleChris backdoor
MemFun backdoor
Getpass credential harvester
Malicious PowerShell execution (Reverse shells)
WMI and native Windows .NET command execution
DLL hijacking (System32 via shadow copy service)
Process hollowing
C2 communication via legitimate cloud services (Dropbox, Pastebin)
Credential dumping (custom Mimikatz DLL)

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…
LINK COPIED TO CLIPBOARD