Security researchers have uncovered a persistent cyber-espionage campaign, suspected to be based in China, targeting military organizations across Southeast Asia since at least 2020. This activity, tracked by Palo Alto Networks Unit 42 as CL-STA-1087, utilizes a custom-developed toolkit designed for precision intelligence gathering rather than bulk data theft.

The Attack Toolkit

The campaign is characterized by the use of newly discovered, objective-oriented malware:

• AppleChris: A static backdoor deployed as a DLL (often named swprv32.sys) or standalone executable. It uses DLL hijacking to masquerade as legitimate Windows processes like the Volume Shadow Copy Service.
• MemFun: A modular, in-memory downloader that employs advanced evasion techniques, such as process hollowing and anti-forensic checks, to avoid leaving artifacts on the disk.
• Getpass: A custom version of the Mimikatz credential harvester used to extract plaintext passwords and NTLM hashes from system memory.

Strategic Objectives

The attackers demonstrate significant “operational patience,” often maintaining dormant access for months to focus on specific high-value targets. Their primary goal is the collection of files related to:

• Military capabilities and organizational structures of regional forces.
• Collaborative efforts between Southeast Asian militaries and Western armed forces.

Targeted Entities

While specific countries vary by report, the campaign is part of a broader trend of state-sponsored activity targeting major regional bodies and national defense offices, including:

• ASEAN (Association of Southeast Asian Nations) mail servers.
• Military and government departments in Vietnam, Malaysia, Indonesia, Thailand, and the Philippines.

Security professionals are encouraged to review the indicators of compromise provided by The Hacker News and Unit 42 to strengthen defenses against these advanced persistent threats.