Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

Unit 42 exposes a China-linked cyber espionage campaign targeting Southeast Asian military organizations since at least 2020.

• •Custom backdoors AppleChris and MemFun use Pastebin as a dead drop resolver to fetch C2 addresses in Base64-encoded format
• •AppleChris is deployed via DLL hijacking and supports drive enumeration, file operations, remote shell execution, and silent process creation
• •MemFun operates as a modular malware platform using process hollowing into dllhost.exe to evade detection, fetching a DLL payload from C2 at runtime
• •Sandbox evasion is achieved via sleep timers (30s for EXE, 120s for DLL) to outlast automated monitoring windows
• •Getpass, a custom Mimikatz variant, extracts plaintext passwords and NTLM hashes from lsass.exe process memory