Two Chinese APT Groups Ramp Up Cyber Espionage Against ASEAN Countries

Two China-linked APT clusters (including Mustang Panda) have been observed targeting ASEAN-affiliated entities with spear-phishing and DLL sideloading to deploy PUBLOAD/PlugX and related backdoors, while Trend Micro attributes widespread targeting by a China-focused actor called Earth Krahang that exploits public-facing Openfire/Oracle server flaws and spear-phishing to deliver PlugX, ShadowPad, ReShell, and DinodasRAT. Separately, leaked I-Soon documents reveal an integrated hack-for-hire capability—selling stealers, RATs, and operational platforms and showing operational ties between the contractor and multiple state-aligned groups—illustrating a sophisticated, outsourced Chinese cyber-espionage ecosystem.