Loading threat actor…
Crimson Palace is a Chinese state-sponsored cyberespionage operation focused on long-term access to high-value government networks in Southeast Asia. The activity has been assessed with high confidence as aligned with Chinese state interests and centered on intelligence collection, including military, political, technical, and infrastructure-related information. Reporting on the campaign identified at least three coordinated intrusion clusters—Cluster Alpha (STAC1248), Cluster Bravo (STAC1807), and Cluster Charlie (STAC1305)—with evidence of related activity dating back to early 2022 and sustained operations continuing into 2024. The operation is notable for extensive use of DLL sideloading, redundant persistence mechanisms, multiple command-and-control implants, and strong operational resilience. Malware and tooling associated with Crimson Palace include CCoreDoor, PocoProxy, EAGERBEE variants, NUPAKAGE, Merlin Agent, Cobalt Strike, PhantomNet, RUDEBIRD, and PowHeartBeat. Cluster Alpha emphasized persistent access, service-based persistence, subnet and Active Directory reconnaissance, and deployment of multiple backdoors in parallel. Cluster Bravo relied heavily on valid accounts for lateral movement and used CCoreDoor for persistence, discovery, credential dumping, and external command and control. Cluster Charlie focused on access management and infrastructure rotation, deployed multiple PocoProxy implants, conducted large-scale event log analysis and network sweeps, captured credentials including via LSASS interception on domain controllers, and attempted exfiltration of sensitive documents and tokens. Crimson Palace demonstrated mature defense-evasion tradecraft, including in-memory tampering to interfere with endpoint security visibility and repeated re-entry after defensive disruption. Operators used web-shell-based re-penetration, custom loaders, process injection, credential interception, and broad reconnaissance across enterprise environments. The campaign’s targeting and collection priorities indicate strategic espionage objectives, including material relevant to South China Sea disputes. The campaign has technical and operational overlaps with several publicly reported China-aligned clusters and malware ecosystems, including Earth Estries, BackdoorDiplomacy, Worok, TA428, Unfading Sea Haze, and Earth Longzhi, but available information does not support high-confidence attribution to a single previously named actor beyond the Crimson Palace designation itself. Crimson Palace should therefore be understood as a coordinated Chinese espionage campaign or umbrella activity set rather than a conclusively unified legacy intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with multiple attacks against government organizations in Southeast Asia.
China-aligned espionage campaign referenced as overlapping with CL-STA-1048 and CL-STA-1049 through shared tooling such as Masol RAT and FluffyGh0st.
Chinese state-sponsored cyberespionage campaign targeting a Southeast Asian government organization to maintain long-term access, conduct reconnaissance, collect sensitive military and technical information, and sustain redundant C2 access.
Chinese state-sponsored cyberespionage campaign against a Southeast Asian government organization, focused on long-term access, reconnaissance, credential theft, and exfiltration of sensitive military/political documents, using extensive DLL sideloading, multiple redundant C2 implants, and evasion (including in-memory unhooking).
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.