Researchers Warn of Chinese-Aligned Hackers Targeting South China Sea Countries

Bitdefender describes an espionage-focused threat actor, "Unfading Sea Haze," active since 2018 that targeted military and government organizations in South China Sea countries using spear-phishing LNK archives, MSBuild-based fileless payloads, scheduled tasks and account manipulation for persistence, and a mix of custom and commodity tools (multiple Gh0st RAT variants, loaders, keyloggers, browser stealers, RMM abuse and Zulip-backed command channels) to perform targeted data collection and manual exfiltration.