Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions

When monitoring for activity of APT groups in the Asian region, Bitdefender researchers found signs of a complex and targeted espionage attack on potential government sector victims in South East Asia, carried out by a sophisticated Chinese APT group, judging from some of the forensic artifacts left behind.

The operation was conducted over at least a few years, as the earliest signs of potential compromise date back to late 2018. While current forensic evidence follows the attack timeline up to 2020, a large number of C&C servers are inactive. It’s likely the overall attacker-controlled infrastructure used in the attack is currently inactive, even though very few C&Cs have been found to still be operational.