China-Linked groups target Southeast Asian government with advanced malware in 2025
2026-03-31T02:51:47Z•4942d58b159f2f443c1288c7d423b3b0e4352b282a3553134bbcd819af59c0a5
APTChina-linkedCitrixFortinetRussia-linkedTelegramdata-breachiOS exploitinfostealermacOSmalwarezero-click
What happened
This feed reports multiple high-risk incidents and campaigns: China-linked APTs conducted a sophisticated 2025 operation against a Southeast Asian government deploying numerous malware families (HIUPAN, PUBLOAD, EggStremeFuel/Loader, MASOL RAT, PoshRAT, TrackBak, Hypnosis Loader, FluffyGh0st). Multiple critical vulnerabilities are active or being probed — Fortinet FortiClient EMS (CVE-2026-21643) is being exploited for RCE, and Citrix NetScaler (CVE-2026-3055) is being actively probed for a critical memory overread. A claimed Telegram zero-click RCE (tracked as ZDI-CAN-30207, CVSS 9.8) was公開ed
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- securityaffairs
- Record identifier
- 4942d58b159f2f443c1288c7d423b3b0e4352b282a3553134bbcd819af59c0a5
- Enrichment time
- 2026-03-31T02:51:47Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.