Crimson Palace
Crimson Palace is a Chinese state-sponsored cyberespionage operation/campaign targeting government organizations in Southeast Asia. Sophos reported a long-running intrusion against a high-profile Southeast Asian government organization, with activity mainly from March to December 2023, evidence of related activity dating back to early 2022, and one cluster continuing into at least April 2024. Sophos tracked at least three intrusion clusters within the campaign: Cluster Alpha (STAC1248), Cluster Bravo (STAC1807), and Cluster Charlie (STAC1305). Sophos assessed with high confidence that the campaign supported Chinese state interests, but refrained from attributing it with high confidence to a single known actor because of common infrastructure and tool sharing across Chinese intrusion sets. The campaign emphasized long-term persistence, redundancy, and espionage. Reported objectives and victim data of interest included military, political, and technical information, including documents related to South China Sea strategy. Tradecraft included extensive DLL sideloading across more than 15 scenarios, abuse of legitimate Microsoft and security-vendor software, Windows service persistence, use of valid accounts for lateral movement, reconnaissance, credential dumping and credential interception, mass event log analysis, automated ping sweeps, and exfiltration attempts. Sophos also reported evasion including in-memory replacement of ntdll.dll to unhook security tooling, and an updated EAGERBEE variant capable of disrupting or blackholing communications to antivirus-vendor domains. Malware and tooling directly reported in connection with Crimson Palace include CCoreDoor, PocoProxy, EAGERBEE, NUPAKAGE, Merlin Agent, Cobalt Strike, PhantomNet (DOWNTOWN), RUDEBIRD, PowHeartBeat, and a custom HUI loader. BitDefender reportedly designated CCoreDoor as EtherealGh0st. Public reporting also linked Crimson Palace-related activity or tooling overlaps with Earth Estries, REF5961, BackdoorDiplomacy, Unfading Sea Haze, Worok/TA428, and APT41 subgroup Earth Longzhi. Separate reporting cited textinputhost.dat as previously leveraged by Crimson Palace in attacks against Southeast Asia, and Unit 42 noted that Masol RAT and EggStreme had been publicly associated with campaigns such as Crimson Palace and Earth Estries. Known aliases directly present in the content: crimson_palace.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
Tradecraft
11 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
7 malware families attributed to this actor across reporting.
2 additional families tracked in Mallory.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with multiple attacks against government organizations in Southeast Asia.
China-aligned espionage campaign referenced as overlapping with CL-STA-1048 and CL-STA-1049 through shared tooling such as Masol RAT and FluffyGh0st.
Chinese state-sponsored cyberespionage campaign against a Southeast Asian government organization, focused on long-term access, reconnaissance, credential theft, and exfiltration of sensitive military/political documents, using extensive DLL sideloading, multiple redundant C2 implants, and evasion (including in-memory unhooking).
China-linked espionage actor conducting targeted campaigns to collect sensitive technical information, recon specific users, and access critical IT systems.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.