Chinese Nexus Actors Shift Focus to Qatar Amid Iranian Conflict

Check Point observed China-aligned APT activity rapidly pivoting to target Qatari organizations after the US-Israeli strike on Iran: one campaign by 'Camaro Dragon' used a malicious archive and LNK to chain into a DLL-hijack of a Baidu NetDisk binary to deploy the PlugX backdoor, while a separate campaign used a password-protected archive and a Rust-based loader abusing nvdaHelperRemote.dll to deploy Cobalt Strike; both used Iran-conflict themed lures and Check Point published IoCs and mitigation recommendations (EDR, MFA, etc.).