Chinese spies suspected of 'moonlighting' as tawdry ransomware crooks

Symantec researchers observed a China-linked espionage group (Mustang Panda/Mustang Panda aliases) exploit a Palo Alto Networks authentication bypass (CVE-2024-0012) in late November to steal admin credentials and Veeam-held AWS S3 credentials, exfiltrate sensitive data, and deploy RA World ransomware demanding $2M; the intruders used a custom PlugX backdoor tied to prior Mustang Panda operations and later resumed espionage targeting government ministries.