China-Backed Hackers Target Southeast Asian Military Systems in Ongoing Spy Campaign

China-linked APT activity (CL-STA-1087) has targeted Southeast Asian military networks since at least 2020 in a long-running espionage campaign focused on high-value intelligence rather than bulk theft. The threat actors use custom backdoors (AppleChris, MemFun) with DDR-based C2 retrieval, in-memory techniques, credential theft via a Mimikatz variant (Getpass), and persistence through service creation and DLL hijacking, enabling stealthy lateral movement across domain controllers, servers, and executive workstations.