{
  "name": "Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia",
  "slug": "suspected-china-based-espionage-operation-against-military-targets-in-southeast-asia",
  "description": "A suspected Chinese state-sponsored espionage campaign targeting Southeast Asian military organizations has been identified, traced back to at least 2020. Designated as CL-STA-1087, the operation demonstrates strategic patience and focused intelligence collection on military capabilities and structures. The attackers deployed custom tools including the AppleChris and MemFun backdoors, and a modified Mimikatz variant called Getpass. The campaign is characterized by the use of dead drop resolvers, custom HTTP verbs, and anti-forensic techniques. Infrastructure analysis reveals long-term persistence and operational compartmentalization. The activity aligns with Chinese working hours and utilizes China-based cloud infrastructure, suggesting a Chinese nexus.",
  "published": "2026-03-16T09:24:58+00:00",
  "created_at": "2026-03-16T09:24:58+00:00",
  "modified_at": "2026-03-16T19:28:21+00:00",
  "created_at_opencti": "2026-03-16T09:24:58+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-03-16",
    "applechris",
    "apt",
    "credential harvesting",
    "espionage",
    "getpass",
    "memfun"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "8.212.169.27"
      },
      {
        "id": "",
        "name": "8.220.184.177"
      },
      {
        "id": "",
        "name": "116.63.177.49"
      },
      {
        "id": "",
        "name": "8.220.135.151"
      },
      {
        "id": "",
        "name": "118.194.238.51"
      },
      {
        "id": "",
        "name": "154.39.142.177"
      },
      {
        "id": "",
        "name": "109.248.24.177"
      },
      {
        "id": "",
        "name": "8.220.177.252"
      },
      {
        "id": "",
        "name": "154.39.137.203"
      },
      {
        "id": "",
        "name": "413daa580db74a38397d09979090b291f916f0bb26a68e7e0b03b4390c1b472f"
      },
      {
        "id": "",
        "name": "9e44a460196cc92fa6c6c8a12d74fb73a55955045733719e3966a7b8ced6c500"
      },
      {
        "id": "",
        "name": "5a6ba08efcef32f5f38df544c319d1983adc35f3db64f77fa5b51b44d0e5052c"
      },
      {
        "id": "",
        "name": "ee4d4b7340b3fa70387050cd139b43ecc65d0cfd9e3c7dcb94562f5c9c91f58f"
      },
      {
        "id": "",
        "name": "0e255b4b04f5064ff97da214050da81a823b3d99bce60cdd9ee90d913cc4a952"
      },
      {
        "id": "",
        "name": "ad25b40315dad0bda5916854e1925c1514f8f8b94e4ee09a43375cc1e77422ad"
      },
      {
        "id": "",
        "name": "2ee667c0ddd4aa341adf8d85b54fbb2fce8cc14aa88967a5cb99babb08a10fae"
      }
    ],
    "malware": [
      {
        "id": "af904131-f7aa-4207-8c2d-5814fec4812e",
        "name": "AppleChris",
        "slug": "applechris"
      },
      {
        "id": "586acf71-2eed-465e-acdf-3792f8f155b6",
        "name": "Getpass",
        "slug": "getpass"
      },
      {
        "id": "3230c025-1ce9-4228-bda0-6ff59bc5f749",
        "name": "MemFun",
        "slug": "memfun"
      }
    ],
    "intrusion_sets": [
      {
        "id": "f4d85785-c079-4a85-bf5e-6668e78edc1d",
        "name": "CL-STA-1087",
        "slug": "cl-sta-1087"
      }
    ],
    "attack_patterns": [
      {
        "id": "74d6e294-54d1-4a21-9dfc-df5870f8ec8e",
        "name": "T1003"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "bb20a9e1-f4f6-459d-94f4-470c6867dc2d",
        "name": "T1053"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "9643a7e9-771b-4396-83a3-26fcec5200e4",
        "name": "T1021.006"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "14ea0786-b57c-4a30-8e4e-46944d17eb18",
        "name": "T1036.004"
      },
      {
        "id": "b15c00da-c412-4429-900c-659de612baf5",
        "name": "T1543.003"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "2fca0274-42fc-483e-a1e3-d9c4ba687d2d",
        "name": "T1574.001"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2026-0628"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://unit42.paloaltonetworks.com/espionage-campaign-against-military-targets",
    "https://otx.alienvault.com/pulse/69b7da7a6e515e00f9cb4184"
  ]
}