Loading story…
Cisco Talos has identified a campaign since 2022 targeting telecommunications and manufacturing sectors in Central and South Asia, using a new PlugX variant with technical overlaps to RainyDay and Turian backdoors. Analysis reveals shared malware loaders, RC4 keys, and infection chains, suggesting a medium-confidence link between Naikon and BackdoorDiplomacy, or shared tooling. The campaign demonstrates advanced DLL sideloading, living-off-the-land techniques, and persistent compromise, with evidence of keylogger activity spanning nearly two years.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On publication of its report, Cisco Talos disclosed a new PlugX variant that shares technical overlap with RainyDay and Turian, including the same sideloaded application, similar loader structures, and shared decryption routines. Talos said the configuration format aligns with RainyDay rather than typical PlugX and attributed the activity to the Chinese-speaking Naikon group with medium confidence, while also noting possible ties to BackdoorDiplomacy.
Talos observed that the long-running compromise in at least one victim environment lasted through December 2024. This showed the operators maintained access over an extended period.
Talos identified keylogger artifacts showing long-lived persistence in at least one victim environment beginning in late 2022. The persistence continued for more than two years, indicating sustained access by the operators.
Cisco Talos reported an espionage-focused campaign active since 2022 targeting telecommunications and manufacturing organizations in Central and South Asia. The activity involved DLL search order hijacking to deliver malware including a new PlugX variant.
Cisco Talos found evidence suggesting the RainyDay backdoor has likely been operational since at least 2016. This establishes the earliest known activity in the cluster of related espionage tooling discussed in the report.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated cyberespionage campaign has been uncovered targeting telecommunications and manufacturing organizations across Central and South Asia. The campaign is attributed to Chinese nation-state actors, specifically the Naikon and BackdoorDiplomacy groups, and leverages a combination of the RainyDay and Turian backdoors alongside a novel variant of the PlugX remote access Trojan. Researchers from Cisco Talos identified that the attackers are exploiting DLL search order hijacking vulnerabilities in Windows to deploy illicit loaders, allowing malicious DLLs to be executed under the guise of legitimate processes. This technique provides the attackers with a stealthy execution context, making detection by security systems more difficult. The malware payloads utilize the GetModuleFileNameA API to acquire executable paths and read encrypted data, employing consistent RC4 encryption keys and a unique XOR-RC4-RtlDecompressBuffer decryption algorithm across all samples. The PlugX variant observed in this campaign is configured in a way that suggests the attackers have access to its original source code, enabling novel deployment methods. The campaign has been active since at least 2022, with PlugX itself having a long history of use in high-profile attacks, including those against the U.S. Office of Personnel Management and European diplomatic agencies. The targeting patterns and malware configurations link this activity to the Naikon group, a unit believed to operate out of Chengdu, China, and associated with the People's Liberation Army. The campaign's focus on telecom and manufacturing sectors indicates a likely intent to gather intelligence and disrupt critical infrastructure in the region. U.S. federal law enforcement has also taken action against PlugX, recently deleting over 4,000 instances of the malware from computers in the United States, highlighting its widespread use. The attackers' use of multiple backdoors and advanced evasion techniques demonstrates a high level of sophistication and persistence. The campaign's reliance on DLL search order hijacking underscores the importance of securing application loading processes and monitoring for anomalous DLL activity. The use of shared encryption keys and decryption algorithms across different malware families suggests coordinated development and operational control. The involvement of both Naikon and BackdoorDiplomacy groups points to collaboration or shared resources among Chinese state-linked threat actors. The campaign's longevity and evolving tactics reflect the ongoing threat posed by Chinese cyberespionage operations to organizations in Asia and beyond. Organizations in targeted sectors are advised to review their security controls, especially around DLL loading and process monitoring, to detect and mitigate similar threats. The discovery of this campaign adds to the growing body of evidence of sustained, state-sponsored cyber operations targeting strategic industries in Asia.
Jun 29, 2026
Multiple cyber-espionage campaigns targeted Japanese and broader Asia-Pacific organizations by combining spear-phishing, watering-hole compromises, and exploitation of both widely used and region-specific software vulnerabilities. Reporting links activity against Japanese government agencies, manufacturers, trading firms, petroleum and mobile organizations, and Taiwan government targets to groups including **DragonOK**, **Blue Termite/Cloudy Omega**, **APT17**, **BRONZE BUTLER/Tick**, and the operators behind **MILE TEA**. Attackers repeatedly abused Japanese software such as **Sanshiro**, **Ichitaro**, and **SKYSEA Client View**, while also relying on older Microsoft Office flaws such as `CVE-2012-0158` and other Windows vulnerabilities to deliver malware including **PlugX**, **Emdivi**, **Agtid**, **Wali**, **Datper**, **NodeRAT**, **Elirks**, **Micrass**, and **Logedrut**. Palo Alto Networks documented a 2015 DragonOK phishing operation against Japanese targets that used the `biosnews[.]info` command-and-control server to stage **Sysget/HelloBridge**, **NFlog**, **PoisonIvy**, **NewCT**, **PlugX**, and the custom **FormerFirstRAT** backdoor. The same threat ecosystem was later tied to a watering-hole attack on an aerospace firm website that served an Adobe Flash exploit for `CVE-2015-5122` and installed the **IsSpace** backdoor, assessed as an evolution of **NFlog**. Separate tracking of **MILE TEA** showed a long-running campaign from at least 2011 through 2016 that used flight e-ticket lures, custom installers, and malware that fetched command-and-control addresses from public blog pages, while Trend Micro reported continued heavy exploitation of legacy flaws, abuse of Dropbox for **PlugX** configuration, and PowerShell launched through malicious `.LNK` files across the region.
Aug 15, 2026
Researchers linked a sustained cyber-espionage campaign against military, government, and intelligence organizations in Southeast Asia to the Chinese-speaking **Naikon** threat actor, which used the **FoundCore**/RainyDay backdoor alongside a newly documented **Nebulae** implant. Bitdefender said Nebulae was typically delivered through **DLL side-loading** with legitimate software and used mainly for persistence and as a fallback access path after defenders detected other malware, while FoundCore handled reconnaissance, credential dumping, lateral movement, payload delivery, and ongoing remote access. Technical reporting shows the intrusions relied on multi-stage loaders, obfuscated shellcode, and hijacked legitimate components to evade analysis and maintain access. Securelist documented related tradecraft in attacks on high-profile Vietnamese organizations, including side-loading through Microsoft Outlook components, RC4-encrypted communications, runtime repair of scrubbed PE headers, and service-based persistence, while separate Kaspersky research tied Naikon to the long-running **Aria-Body** backdoor family used against executive, law enforcement, military, and intelligence entities across the South China Sea region. The combined reporting indicates Naikon continued refining a long-running regional espionage toolkit rather than conducting isolated intrusions.
Aug 15, 2026