Mofang: A politically motivated information stealing adversary

Mofang is a likely Chinese, government-affiliated threat actor conducting politically motivated information-stealing campaigns—notably against Myanmar’s government and critical infrastructure—and has targeted multiple countries and sectors using custom tools (ShimRat and ShimRatReporter). The group relies on social engineering rather than exploits for initial access, employs shim-based persistence and built-in privilege elevation in its malware, and operates through reconnaissance, faux infrastructure, and a primary compromise phase to achieve its objectives.