Chinese and N. Korean Hackers Target Global Infrastructure with Ransomware

Threat actors with suspected China and North Korea ties conducted ransomware and encryption attacks globally from 2021–2023 against government and critical-infrastructure targets; one cluster (ChamelGang/CamoFei) used CatB ransomware and custom backdoors, while a second set of intrusions leveraged BestCrypt/BitLocker and artifacts linked to APT41 and Andariel. Researchers observed sophisticated tooling (BeaconLoader, Cobalt Strike, DoorMe, DTrack, China Chopper), estimated ~37 organizations targeted (notably in manufacturing and public sector), and warn that ransomware is being used as a final-stage tactic to monetize, disrupt, misattribute, or remove forensic evidence of espionage.