Chinese-based Ink Dragon Compromises Asia and South America into European Government Networks

Ink Dragon, a Chinese espionage group, has methodically expanded operations from Southeast Asia and South America into European government networks, using stolen credentials, dormant administrative sessions, and exploitation of web server/SharePoint configuration weaknesses to gain initial access. The group employs advanced techniques—transforming compromised servers into relay nodes and using an updated FinalDraft backdoor that hides commands in Microsoft mailbox drafts—to maintain long-term, stealthy access and exfiltrate data, with overlap observed from other actors like RudePanda in the same environments.