09/29/2025
🚨 Chinese-linked malware targets Asian telecom and ASEAN networks.
Researchers have discovered a fresh wave of cyberattacks on telecom and manufacturing industries in Central and South Asia.
🔎 What’s new:
- A new version of PlugX (a renowned remote access trojan) is being employed. PlugX has long been a favorite tool among China-linked hacker organizations.
- This new version overlaps with the RainyDay and Turian malware backdoors, demonstrating common methods and techniques across Chinese-speaking attack organizations.
- Naikon (Lotus Panda) and Backdoor Diplomacy are suspected groups, raising the question of whether they collaborate or use tools from the same vendor.
📡 How the assaults work:
Hackers employ a tactic called DLL side-loading to run malware through legitimate software, such as mobile popup programs. When inside, PlugX can:
- Steal keystrokes using an integrated keylogger.
- Decrypt and launch several payloads.
- Blend in with typical software to remain hidden.
💀 Meanwhile, Mustang Panda (aka Stately Ta**us) continues to use its long-running Bookworm malware, which has been active since 2015, in assaults targeting ASEAN countries.
- Bookworm is modular, allowing hackers to add new features remotely.
- It can execute orders, steal files, and remain persistent during long-term espionage.
- Newer versions mask code as innocuous-looking UUID sequences.
👉 These attacks highlight the blurred borders between China-linked organizations. Whether they collaborate or just share tools, the result is the same: vital industries such as telecom are under threat in Asia, with spillover implications for global supply chains and communications.
