China

Gbhackers •Mayura Kathir • May 26, 2026

China-linked hackers are conducting a stealthy infrastructure-centric espionage campaign across Southeast Asia by compromising Linux-based edge routers with a custom ELF implant and pairing it with a cracked Cobalt Strike Beacon on Windows systems for unified command-and-control over entire networks. The operation enables full visibility into, and manipulation of, downstream traffic while largely bypassing traditional […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

China-linked Hackers Target Southeast Asia's Edge Routers with Custom Malware A China-linked hacking group is executing an espionage campaign targeting Linux-based edge routers across Southeast Asia. The attackers deploy a custom ELF implant, named router.elf, to gain deep control over network traffic. This operation utilizes a cracked Cobalt Strike Beacon on Windows systems for command-and-control, allowing extensive visibility and manipulation of downstream traffic. The campaign is rated critical in severity due to its potential to affect numerous organizations beyond the initial targets. The full scope of the impact remains unclear, but the operation is ongoing. Security experts are urging immediate attention to this threat as it poses significant risks to critical infrastructure. 2 sources 75

Extracted Entities

China

The full story

Extracted Entities

Attack Types (1)

Countries (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (2)

Tools (1)