Sharp Dragon Expands Towards Africa and The Caribbean

Sharp Dragon (formerly Sharp Panda), a Chinese state-linked APT, expanded targeting from Southeast Asia into Africa and the Caribbean by leveraging compromised government email accounts to distribute RoyalRoad-weaponized documents and executables that install 5.t loaders and Cobalt Strike Beacon; the report details evolving TTPs (wider recon, EXE loaders, use of public tooling), extensive IOCs (file hashes, C2 IPs/domains), and suspected exploitation of CVE-2023-0669 to repurpose compromised servers as C2.