Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

"The activity demonstrated strategic operational patience and a focus on highly targeted intelligence collection, rather than bulk data theft. The attackers behind this cluster actively searched for and collected highly specific files concerning military capabilities, organizational structures, and collaborative efforts with Western armed forces."

"The campaign exhibits hallmarks commonly associated with advanced persistent threat (APT) operations, including carefully crafted delivery methods, defense evasion strategies, highly stable operational infrastructure, and custom payload deployment designed to support sustained unauthorized access to compromised systems."

"The infection sequence involves the deployment of AppleChris, different versions of which are dropped across target endpoints following lateral movement to maintain persistence and evade signature-based detection. The threat actors have also been observed conducting searches related to official meeting records, joint military activities, and detailed assessments of operational capabilities."

Palo Alto Networks Unit 42 identified a state-sponsored cyber espionage campaign designated CL-STA-1087 targeting Southeast Asian military organizations. The operation demonstrates strategic patience and focused intelligence collection rather than bulk data theft. Attackers deployed custom backdoors named AppleChris and MemFun, along with a credential harvester called Getpass. The campaign exhibits advanced persistent threat characteristics including carefully crafted delivery methods, defense evasion strategies, and stable operational infrastructure. Detection occurred through suspicious PowerShell execution that entered sleep states before creating reverse shells to threat actor-controlled command-and-control servers. The infection sequence involves AppleChris deployment across endpoints following lateral movement to maintain persistence and evade detection. Attackers specifically searched for official meeting records, joint military activities, and operational capability assessments.

Read at The Hacker News