Three China-Linked Clusters Target Southeast Asian Government in 2025 Cyber Campaign

Three China-linked threat clusters conducted a coordinated cyber campaign targeting a Southeast Asian government organization in 2025.

• •Mustang Panda (June–Aug 2025) used USB-based HIUPAN malware to deliver the PUBLOAD backdoor via a rogue DLL loader called Claimloader, also deploying COOLCLIENT for keystroke recording and tunneling.
• •CL-STA-1048 (Mar–Sep 2025), overlapping with Earth Estries and Crimson Palace, deployed EggStremeFuel, EggStremeLoader (59 backdoor commands, Dropbox-based exfiltration), MASOL RAT, and TrackBak Stealer.
• •CL-STA-1049 (Apr and Aug 2025), overlapping with Unfading Sea Haze, used a novel DLL loader called Hypnosis Loader via DLL side-loading to install FluffyGh0st RAT.
• •Unit 42 researchers assessed the clusters share overlapping TTPs with known China-aligned actors, suggesting coordination toward persistent access to sensitive government networks.