Chinese State-Backed Cyber Espionage Targets Southeast Asian Government

Sophos researchers disclosed "Crimson Palace", a complex, long-running Chinese state‑sponsored cyber espionage campaign against an unnamed Southeast Asian government entity, composed of three overlapping intrusion clusters that used undocumented and known malware (including PocoProxy, EAGERBEE, EtherealGh0st, NUPAKAGE and others), extensive DLL sideloading, AV-evasion techniques, and loaders like HUI Loader to deploy Cobalt Strike; the report links activity to multiple China-nexus actors and notes similar APT41 operations and government advisories on increasing Chinese cyber threats.