Weaver Ant data exfiltration campaign (Campaign)

Sygnia tracked a long-running China-nexus APT campaign dubbed Weaver Ant that maintained covert access to a major Asian telecom for over four years using advanced web shells (including an AES-encrypted China Chopper and an INMemory web shell), trojanized DLLs, credential theft, recursive HTTP tunneling, AMSI/ETW evasion, and in-memory execution to perform reconnaissance, lateral movement, and data exfiltration.