Chinese Ink Dragon Group Hides in European Government Networks

Check Point warns that China-linked Ink Dragon is exploiting misconfigured public-facing servers (IIS, SharePoint) in European government networks to quietly gain domain-level access, harvest credentials, move laterally via RDP, and convert compromised servers into relay nodes using a customized IIS module and the FinalDraft backdoor; the activity expands previous campaigns in Asia and South America and overlaps with other advanced actors like RudePanda, demonstrating how single unpatched weaknesses enable multiple nation-state operations.