Separating the bee from the panda: CeranaKeeper making a beeline for Thailand

ESET identifies CeranaKeeper, a China-aligned APT that has targeted governmental organizations across Asia since at least 2022; the group employs revamped TONESHELL components and bespoke tools (WavyExfiller, DropboxFlop, OneDoor, BingoShell) that abuse Pastebin, Dropbox, OneDrive, GitHub and other services for stealthy command-and-control and large-scale document exfiltration, and the report provides technical analysis, IoCs, hosting details, and ATT&CK mappings.