U.S. org suffered four month intrusion by Chinese hackers

Symantec observed China-based threat actors maintain persistent access to multiple machines in a large U.S. organization with a China presence from April to August 2024, using Kerberoasting, living‑off‑the‑land tools (PowerShell, WMI, PsExec), renamed/open-source utilities (FileZilla/Putty components, PSCP), WinRAR, and DLL sideloading to establish persistence, perform reconnaissance, lateral movement, and likely exfiltrate email/data from Exchange servers; some tools overlap with prior Chinese campaigns, but firm attribution remains tentative.