Chinese APT Hackers Using Proxy and VPN Service to Anonymize Infrastructure

**Executive Summary:** Researchers report a sustained Chinese APT campaign that weaponized a zero-day Office RCE (CVE-2025-1234) to deploy a Go-based Trojan proxy which tunnels C2 and exfiltration through WgetCloud VPN exit nodes, leveraging wildcard TLS certificates (*.appletls.com) on ports 4000–4099 to evade detection and steal intellectual property from targets in South Korea and Taiwan.