China-linked Hackers Target Southeast Asia's Edge Routers with Custom Malware

A China-linked hacking group is executing an espionage campaign targeting Linux-based edge routers across Southeast Asia. The attackers deploy a custom ELF implant, named router.elf, to gain deep control over network traffic. This operation utilizes a cracked Cobalt Strike Beacon on Windows systems for command-and-control, allowing extensive visibility and manipulation of downstream traffic. The campaign is rated critical in severity due to its potential to affect numerous organizations beyond the initial targets. The full scope of the impact remains unclear, but the operation is ongoing. Security experts are urging immediate attention to this threat as it poses significant risks to critical infrastructure.

Key Points: • China-linked hackers are targeting Linux-based edge routers in Southeast Asia. • The attack employs a custom ELF implant and a cracked Cobalt Strike Beacon. • The campaign has been rated critical due to its extensive impact and ongoing nature.