CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia

Unit42 describes CL-STA-0048, a sophisticated espionage campaign targeting high-value South Asian organizations (government and telecom) that exploited public-facing IIS, Apache Tomcat and MSSQL servers to gain access, deployed PlugX and Cobalt Strike (including DLL sideloading and privilege escalation), used a stealthy "Hex Staging" delivery method and DNS-based exfiltration to steal PII, and provides detailed mitigations and IoCs.