Chinese Cyber Threat Lurks In Critical Asian Sectors for Years

Unit 42 reports that a Chinese-speaking threat cluster tracked as CL-UNK-1068 has conducted cross-platform cyber-espionage against critical infrastructure and government-related sectors across Asia since at least 2020, using web-server exploitation and web shells for initial access, credential-dumping tools (e.g., Mimikatz, LsaRecorder), custom scanners (ScanPortPlus), persistence techniques such as DLL sideloading via legitimate Python binaries, tunneling tools (modified FRP), and Linux backdoors (Xnote); the report includes IoCs and defensive guidance to detect and mitigate these activities.