Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure

Unit 42 describes a years-long Chinese-linked espionage campaign (CL-UNK-1068) targeting aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications organizations across South, Southeast, and East Asia. The adversary employs a mix of custom malware, modified open-source utilities, web shells (e.g., Godzilla, ANTSWORD), Linux backdoors (Xnote), FRP for persistence, DLL side‑loading via legitimate Python binaries, and living‑off‑the‑land techniques to steal credentials and exfiltrate sensitive files (archived with WinRAR, Base64-encoded with certutil) while maintaining stealthy access.