Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

Palo Alto Networks Unit 42 attributes a long-running, China-linked espionage campaign (CL-STA-1087) targeting Southeast Asian military organizations since at least 2020. The actors used custom backdoors (AppleChris, MemFun), a credential harvester (Getpass/Mimikatz variant), and operational techniques like DLL hijacking, process hollowing, Pastebin/Dropbox-based C2 retrieval, and sandbox-evasion sleep timers to stealthily collect sensitive C4I and joint-military intelligence.