China-linked Billbug hackers breached multiple entities in Southeast Asian country

Symantec attributes a prolonged espionage campaign (Aug 2024–Feb 2025) in a Southeast Asian country to the Chinese APT group Billbug (Lotus Panda/Lotus Blossom/Bronze Elgin); attackers breached multiple high-profile targets including a government ministry, air traffic control, a telecom operator and a construction firm using custom credential stealers, backdoors and legitimate tools (including timestomping), and researchers note links to prior operations such as a compromise of a digital certificate authority.