China-Linked groups target Southeast Asian government with advanced malware in 2025

In 2025, multiple China-linked threat clusters conducted a coordinated cyberespionage campaign against a Southeast Asian government, deploying a range of sophisticated malware (including PUBLOAD delivered via USBFect/USBFect, CoolClient loaders, EggStremeFuel, MASOL RAT, TrackBak, Hypnosis Loader and FluffyGh0st) to achieve persistent access, lateral movement, keystroke/clipboard/data theft, and exfiltration; Palo Alto Unit 42 links the activity to known China-aligned actors and highlights extensive tool overlap and stealthy loader techniques used to maintain long-term access.