Chinese State-Backed Hackers Target Southeast Asian Militaries with Custom Malware

Chinese Hackers Target Southeast Asian Militaries with AppleChris and MemFun Malware

Palo Alto Networks Unit 42 has identified a state-sponsored cluster, CL-STA-1087, targeting Southeast Asian military organizations for high-value intelligence. The campaign utilizes a shared Pastebin account acting as a dead drop resolver for C2 infrastructure that dates back to September 2020.

Why This Matters

While ideal security models assume rapid detection of unauthorized access, CL-STA-1087 demonstrates extreme operational patience by maintaining dormant access for months. The technical reality involves the use of modular platforms like MemFun and anti-forensic techniques such as process hollowing and timestamp stomping, which effectively bypass automated sandboxes by using 120-second sleep timers to outlast standard monitoring windows. This shift from bulk data theft to targeted intelligence collection on C4I systems highlights a sophisticated evolution in state-sponsored espionage tactics.

Key Insights

• CL-STA-1087 targeted military strategy and C4I systems since at least 2020 according to Palo Alto Networks Unit 42.
• Malware variants like AppleChris use DLL hijacking and dead drop resolvers via Pastebin or Dropbox to fetch Base64-encoded C2 addresses.
• MemFun operates as a modular platform, injecting shellcode into dllhost.exe via process hollowing to evade disk-based detection.
• The Getpass tool is a custom Mimikatz variant used to extract plaintext passwords and NTLM hashes directly from lsass.exe process memory.
• Sandbox evasion is achieved through delayed execution timers of 30 to 120 seconds to bypass the typical monitoring windows of automated systems.

Practical Applications

• Threat actors utilize dllhost.exe process hollowing to run malicious payloads under legitimate Windows processes to avoid disk artifacts. Pitfall: Relying on signature-based disk scanning rather than behavioral memory analysis allows in-memory threats to persist.
• Implementing dead drop resolvers via public services like Pastebin allows attackers to rotate C2 infrastructure without updating the malware binary. Pitfall: Neglecting to monitor outbound traffic to developer-centric domains can result in undetected command-and-control channels.
• Attackers use timestamp stomping to match Windows System directory file creation times. Pitfall: Forensic timelines that rely solely on file metadata can be easily manipulated to hide recent lateral movement or malware installation.

References:

• http://thehackernews.com/2026/03/chinese-hackers-target-southeast-asian.html