Introducing the REF5961 intrusion set

Elastic Security Labs details REF5961 (and related REF2924) activity: discovery and analysis of multiple Windows backdoors (EAGERBEE, RUDEBIRD, DOWNTOWN and references to BLOODALCHEMY) used in state-aligned espionage against ASEAN governments. The report includes behavioral and code analyses, network infrastructure links (including Mongolian C2 overlap), YARA rules, IOCs (SHA-256 hashes and IPs), and moderate-to-high confidence attribution to a China-nexus actor.