Crimson Palace — APT Profile
Crimson Palace is a Chinese espionage operation targeting a Southeast Asian government ministry using multiple distinct malware clusters simultaneously.Also tracked as
Cluster Bravo (STAC1870), Operation Crimson Palace, Cluster Charlie (STAC1305), Cluster Alpha (STAC1248)
Tools & malware
- CCoreDoor Backdoor
- Cobalt Strike Framework
- EAGERBEE Backdoor
- Havoc Framework
- HUI Loader Loader
- Merlin C2 Agent Framework
- NUPAKAGE Tool
- PhantomNet (SManager) Backdoor
- PocoProxy Backdoor
- PowHeartBeat Backdoor
- RUDEBIRD Backdoor
- TattleTale Stealer
Vendor research
- Operation Crimson Palace: A Technical Deep Dive Sophos
- Crimson Palace returns: New Tools, Tactics, and Targets Sophos
- Operation Crimson Palace, Chinese State-Sponsored Espionage, Expands in Southeast Asia, Sophos Report Finds Sophos
- Chinese 'Crimson Palace' espionage campaign keeps hacking Southeast Asian governments The Record (Recorded Future News)