Analysis of Threat Clusters Targeting Southeast Asian Government

Unit 42 researchers identified a sustained cyberespionage campaign between June and August 2025 targeting a government organization in Southeast Asia. The activity is divided into three distinct clusters—Stately Taurus, CL-STA-1048, and CL-STA-1049—all showing significant overlaps with known China-aligned operations like Crimson Palace, Earth Estries, and Unfading Sea Haze. These actors utilized a combination of USB-based propagation, DLL sideloading, and novel loaders to maintain long-term persistence within the victim's network.

The technical analysis reveals a sophisticated multi-payload strategy. Stately Taurus leveraged the USBFect worm to deploy PUBLOAD and CoolClient, while CL-STA-1048 utilized a diverse toolkit including EggStremeFuel, Masol RAT, and the Gorem RAT. CL-STA-1049 employed the novel Hypnosis loader to deploy FluffyGh0st RAT. The use of varied and redundant tooling suggests a highly resource-intensive effort designed to bypass XDR protections and ensure continuous data exfiltration.

This activity underscores the persistent threat posed by state-sponsored actors to government entities in the South China Sea region. The coordination or convergence of these clusters indicates a high-priority strategic objective, with an emphasis on stealthy persistence and information theft rather than immediate disruption.