TLDR Tech / InfoSec
Converging Interests: Analysis of Threat Clusters Targeting a Southeast Asian Government
Unit 42 uncovered three simultaneous, China-aligned threat clusters targeting a Southeast Asian government between June and August 2025: Stately Taurus deployed the USBFect worm (aka HIUPAN) to propagate the PUBLOAD backdoor via removable media, CL-STA-1048 rotated through a noisy multi-RAT toolkit spanning EggStremeFuel, Masol RAT, EggStreme Loader, Gorem RAT, and the TrackBak infostealer in an apparent attempt to evade XDR detection, and CL-STA-1049 used a novel DLL sideloading chain called Hypnosis loader to quietly deliver FluffyGh0st RAT. TTP overlaps tie the clusters to Earth Estries, Unfading Sea Haze, and the Crimson Palace campaign, suggesting that distinct but aligned operators are coordinating to target the same high-value network. Defenders should monitor for DLL sideloading against legitimate security vendor binaries, USB-propagated payloads masquerading under ProgramData\Intel paths, and C2 traffic to the listed IOCs.
Read the full story