Chinese Tag Team APTs Keep Stealing Asian Gov't Secrets

Operation Crimson Palace is a China-linked, multi-cluster APT campaign active since March 2023 and increasingly active in 2024; Sophos attributes at least a dozen compromises (including a prominent Southeast Asian government agency) to three specialized clusters where Alpha handles initial access, Bravo manages infrastructure and C2 relays, and Charlie performs sophisticated persistence, evasion, and data exfiltration using a combination of custom tooling and open-source frameworks.