Chinese Threat Clusters Triple-Team High-Profile Asia Government Org

Sophos researchers uncovered "Operation Crimson Palace," a coordinated set of Chinese state-aligned threat clusters that from 2022–2024 compromised a Southeast Asian government, using DLL sideloading, multiple novel backdoors (including Nupakage, variants of Eagerbee, CCoreDoor, and PocoProxy), credential theft, and lateral movement to exfiltrate large volumes of sensitive military and political documents.