'China-aligned' spyware slingers operating since 2018 unmasked at last

Bitdefender uncovered a long-running targeted campaign by a group dubbed Unfading Sea Haze, likely linked to Chinese interests, which used spear-phishing (ZIP attachments with LNK files) to deploy data-stealing malware (Gh0st RAT family, Ps2dllLoader) against at least eight government and military organizations since 2018; the actors evolved to in-memory execution via PowerShell and MSBuild, used scheduled tasks to load malicious DLLs for credential and browser data theft, and exfiltrated data over FTP (curl) — the report includes technical indicators and mitigation guidance.