China

Back Securityaffairs.Co

China

Securityaffairs.Co •Pierluigi Paganini • March 30, 2026

Share: View original

China-linked groups hit a Southeast Asian government in 2025, deploying multiple malware families in a sophisticated cyber campaign. In 2025, three China-linked threat clusters targeted a Southeast Asian government in a complex, well-funded cyber operation. Threat actors deployed numerous malware types, including HIUPAN, PUBLOAD, EggStremeFuel/Loader, MASOL RAT, PoshRAT, TrackBak Stealer, Hypnosis Loader, and FluffyGh0st, showing […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

China-linked Cyber Campaign Targets Southeast Asian Government In 2025, multiple China-linked threat groups executed a sophisticated cyber campaign against a Southeast Asian government, utilizing various malware families to achieve persistent access and exfiltrate sensitive data. The operation involved three distinct clusters: Mustang Panda, CL-STA-1048, and CL-STA-1049, each employing advanced techniques and a range of malware including HIUPAN, PUBLOAD, and FluffyGh0st. Mustang Panda notably used the USBFect worm for propagation via infected USB drives, facilitating lateral movement and data theft. The campaign spanned from March to September 2025, indicating a well-coordinated effort with significant resources. The impact of the attack remains under assessment, but the sophisticated nature of the operation suggests a serious breach of security for the affected government. 2 sources 73

Extracted Entities

Attack Types (1)

Countries (1)

Industries (1)

Malware (8)

EggStremeFuel/Loader FluffyGh0st Hiupan Hypnosis Loader Masol RAT PoshRAT Pubload TrackBak Stealer