CL-STA-0048

CL-STA-0048 is a China-linked, state-backed espionage cluster assessed to operate as an advanced persistent threat. It has been associated with intrusions against high-value organizations in South Asia and with broader exploitation of internet-facing enterprise applications, including SAP NetWeaver and IIS infrastructure. Reported victimology includes a telecommunications organization and critical-infrastructure and government-related environments, with targeting tied to strategic intelligence collection and theft of sensitive organizational and personal data. The actor has been observed systematically probing and exploiting public-facing IIS, Apache Tomcat, ColdFusion, MSSQL, Ivanti CSA, and SAP NetWeaver systems, including exploitation of CVE-2025-31324. In SAP-related operations, CL-STA-0048 has been linked to large-scale post-compromise activity involving extensive command execution, network discovery, and SAP-specific application mapping, likely to prepare for lateral movement. Reporting also ties the cluster to exploitation of SAP environments connected to critical infrastructure networks. CL-STA-0048 uses a diverse toolset and layered post-exploitation tradecraft. Observed malware and tooling include PlugX, Cobalt Strike, SoftEther VPN, Stowaway, Winos4.0-based malware, privilege-escalation tooling from the Potato Suite, and UAC bypass tooling. The actor has used DLL sideloading to launch malware, process injection for payload execution, and stealth-oriented delivery methods such as hex-encoded staging of payload fragments. It has also used DNS-based beaconing and exfiltration, including encoding stolen data into DNS queries triggered through native utilities. Additional tradecraft includes reconnaissance via shell and PowerShell commands, credential-access attempts against LSASS, creation of privileged SQL users, database enumeration, and harvesting of personally identifiable and other sensitive records from SQL databases. Attribution to China is supported by multiple indicators including Chinese-language tooling, overlaps with other China-aligned intrusion sets, infrastructure patterns, and operator working hours aligned with UTC+8. The cluster has also been noted as tactically proximate to other China-linked IIS-focused activity such as DragonRank and OP-512. Overall, CL-STA-0048 is characterized by adaptive intrusion behavior, repeated exploitation of exposed edge services, stealthy post-exploitation, and a primary focus on cyber-espionage and data theft.