Loading story…
Security researchers reported multiple China-linked cyber-espionage operations aimed at Russian-speaking targets, including Russian state-owned defense research institutes within Rostec, a related research entity in Belarus, and systems associated with Russian officials. The campaigns used spear-phishing lures tied to U.S. sanctions, the Ukraine war, biological pathogen themes, and Belarus border tensions to entice victims into opening disguised executables or malicious documents delivered through fake websites and staged downloads.
The intrusions deployed distinct malware families and loaders, including the newly identified SPINNER backdoor and updated PlugX tooling. Researchers said the activity relied on DLL sideloading/search-order hijacking, multi-stage loaders, in-memory decryption, persistence mechanisms, and anti-analysis techniques such as dynamic API resolution and control-flow obfuscation. Check Point assessed the Twisted Panda operation with high confidence as Chinese state-backed espionage with tradecraft overlaps to Mustang Panda and APT10, while Secureworks linked the PlugX activity to BRONZE PRESIDENT, indicating a broader Chinese intelligence effort focused on Russian defense and government-related targets after the invasion of Ukraine.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Check Point said the Twisted Panda espionage activity was observed as recently as April 2022. This indicated the campaign remained active after the March phishing wave.
On March 23, several Russian defense research institutes affiliated with Rostec received spear-phishing emails themed around U.S. sanctions on Russia, while a similar lure about deadly pathogens in Belarus was sent to an entity in Minsk. The emails linked to a fake Russian Health Ministry site and delivered malicious documents.
Secureworks analyzed a March 2022 malicious executable masquerading as a Russian-language document that downloaded a signed executable, a malicious DLL, and an encrypted payload likely to be PlugX. CTU assessed the tradecraft and infrastructure as consistent with the China-based BRONZE PRESIDENT threat group.
Secureworks reported that zyber-i.com was hosted on 103.107.104.19 from March 2 to 13 and served similarly named files used for DLL search order hijacking in a broader PlugX campaign. CTU said the domain had been implicated in targeting European diplomatic entities.
Check Point said the Twisted Panda espionage operation had been active since at least June 2021 as part of a longer-running campaign. The activity was later assessed with high confidence as conducted by a Chinese state-backed threat actor.
Secureworks cited reporting that associated the domain locvnpt.com with attacks against the Vatican that CTU attributed to BRONZE PRESIDENT. It also noted the domain was hosted on 2EZ Networks at IP 167.88.177.151 in September 2020.
Check Point Research published an analysis of the Twisted Panda campaign targeting Russian defense institutes and a Belarus research entity. The report introduced the SPINNER backdoor and assessed the operation as part of a broader Chinese state-sponsored espionage effort with overlaps to Mustang Panda and APT10/Stone Panda tradecraft.
Secureworks CTU published research describing an apparent March 2022 attempt to deploy likely PlugX malware against Russian-speaking targets using DLL side-loading and related infrastructure. The report linked the activity to BRONZE PRESIDENT and provided indicators of compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
gbhackers.com
Open sourceresearch.checkpoint.com
Open sourcesecureworks.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Chinese state-linked intrusion groups have continued broad cyberespionage operations against governments, critical infrastructure, telecommunications, finance, technology, and research organizations across Europe, Southeast Asia, Russia, the United States, and other regions. Public reporting from ENISA/CERT-EU, CISA, and private threat intelligence firms links multiple campaigns to clusters including **APT27**, **APT30**, **APT31**, **GALLIUM**, **Mustang Panda**, **APT41/RedGolf**, **TA459**, and **RedHotel**, with activity focused on information theft, persistent access, and in some cases economic espionage. Authorities and researchers said these actors repeatedly exploited exposed enterprise systems such as Microsoft Exchange, SharePoint, Zimbra, Pulse Connect Secure, Citrix ADC, F5 BIG-IP, VMware vCenter, Atlassian Confluence, and ManageEngine, while also using spear-phishing, EU-themed lures, and spoofed domains to gain entry.
Aug 15, 2026
Reporting highlighted multiple **state-sponsored espionage** operations, including a China-linked campaign attributed to **Camaro Dragon** targeting entities in **Qatar** with conflict-themed phishing lures that install the **PlugX** backdoor. The activity was observed rapidly following a new Middle East escalation, using war-related decoy documents and parallel infection chains with differing delivery methods and payloads, indicating more than one operator set involved and underscoring how quickly geopolitical events are operationalized for access and collection. Separately, **Russia’s APT28** (aka *Fancy Bear/Forest Blizzard/Sednit*) was reported using a heavily modified variant of the open-source **Covenant** post-exploitation framework alongside implants such as **BeardShell** and **SlimAgent** in long-term espionage against **Ukrainian** targets. The tradecraft described includes exploitation of `CVE-2026-21509` via malicious Microsoft Office documents and command-and-control over legitimate cloud services (e.g., *Icedrive*), consistent with stealth-focused persistence and surveillance operations against government and military-related environments.
Jun 29, 2026
China-linked **Mustang Panda** continued deploying **PlugX** in espionage operations targeting government and diplomatic entities across Asia, with reporting tying activity to victims in **Indonesia, Vietnam, Taiwan, and Japan**. Researchers linked multiple intrusions to politically themed and administrative lures, including election-related documents, tax and education themes, and regional diplomatic topics. In Indonesia, PlugX command-and-control traffic was found on networks belonging to at least ten ministries and agencies, including the national intelligence service, while separate investigations described likely Mustang Panda activity against Vietnamese organizations and campaigns aimed at Taiwanese government officials and diplomats. Across the cases, the group repeatedly used **DLL sideloading**, staged loaders, and obfuscated payloads to install PlugX in memory while maintaining persistence through **Run** registry keys and encrypted configuration data. Recent samples used lure archives, malicious **LNK** files, **MSI** packages, and decoy PDFs, then chained tools such as PowerShell, `mshta`, `rundll32`, and legitimate executables to sideload malicious DLLs and decrypt DAT payloads. Analysts also highlighted evolving tradecraft, including Nim- and Golang-based loaders, RC4 and XOR-based configuration protection, reflective loading, and time-restricted or rotating command-and-control infrastructure such as **coastallasercompany.com**, **ivibers[.]com**, **meetvibersapi[.]com**, and earlier temporally activated domains associated with prior PlugX campaigns.
Aug 15, 2026