Loading threat actor…
CL-STA-1087 is a suspected China-linked, state-backed cyber espionage cluster active since at least 2020 and focused on military organizations in Southeast Asia. The operation is characterized by selective intelligence collection rather than indiscriminate theft, with collection priorities including military capabilities, organizational structures, C4I systems, official meeting records, joint military activities, and cooperation with Western armed forces. The actor demonstrates long-term persistence, operational patience, and strong defense evasion. Reported tradecraft includes dormant access periods lasting months, persistence on unmanaged endpoints, reverse-shell deployment, lateral movement using WMI and .NET commands, DLL hijacking, sandbox evasion through delayed execution, process hollowing, reflective DLL loading, timestomping, and in-memory execution designed to minimize forensic artifacts. Malware associated with CL-STA-1087 includes the AppleChris and MemFun backdoors and the Getpass credential harvester. AppleChris has been used as a backdoor and tunneler supporting file access, remote shell execution, process control, and proxying, while using dead-drop resolution to obtain command-and-control information. MemFun is a modular, multi-stage backdoor that operates largely in memory and retrieves components at runtime. Getpass is a custom credential-harvesting tool derived from Mimikatz and used to extract authentication material from Windows systems. The campaign reflects an espionage-oriented intrusion set with tailored malware, stealthy post-compromise operations, and sustained infrastructure maintenance consistent with advanced persistent threat activity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
36 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
16 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Espionage campaign targeting Southeast Asian military organizations since at least 2020, focused on collecting intelligence related to military capabilities, organizational structures, C4I systems, and collaboration with Western armed forces.
China-based cyber espionage cluster conducting a state-sponsored intelligence collection campaign since at least 2020 against Southeast Asian military organizations, with emphasis on military capabilities, organizational structures, C4I systems, and collaboration with Western armed forces.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.