Telecom
Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds
Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.
Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.
After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.
While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.
“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.
“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.
“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.
“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”
Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.
While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.
In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.
Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.
Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.
However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.
“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.
“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.
To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).
For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.
MTN Group has committed $2 billion to the International Telecommunications Union’s (ITU) Partner2Connect initiative, bringing the total funds pledged to $73 billion.
The announcement was made during the ongoing Mobile World Congress (MWC 2025) in Barcelona, Spain.
Partner2Connect, spearheaded by the ITU, is a global initiative aimed at enhancing universal digital access, strengthening infrastructure, and fostering meaningful connectivity.
Doreen Bogdan-Martin, secretary-general, ITU, highlighted the significance of these commitments, stating, “Expansive digital infrastructure highlights how much humanity values and depends on meaningful connectivity. These new pledges bring us closer to delivering sustainable digital transformation to everyone, everywhere.”
According to the ITU, MTN Group has shown a strong commitment to investing in Africa’s digital future, spending approximately $2 billion annually on capital expenditures across its markets over the past five years.
Similar investments are planned over the next five years, focusing on expanding and improving voice and data networks to bolster connectivity and drive digital inclusion.
The ITU also announced a $2 billion pledge from Globalstar to expand its low-Earth orbit satellite network, providing seamless, energy-efficient connectivity solutions for remote regions and underserved areas.
These efforts will include direct-to-device (D2D) and IoT connectivity solutions.
As ITU celebrates its 160th anniversary, the UN agency has emphasised its dedication to bridging the global digital divide.
An estimated 2.6 billion people worldwide remain offline, according to ITU data.
The agency has called for $100 billion in commitments by 2026 to fund projects supporting global digital transformation, particularly in hard-to-reach communities.
With over 1,000 pledges spanning 147 countries, Partner2Connect is working toward ITU’s vision of a digitally connected and inclusive future.
Current estimates suggest $1.6 trillion is required for global connectivity hardware alone, with the majority of resources needed in developing nations.
The funds pledged by MTN Group and other partners are set to strengthen digital infrastructure, enhance connectivity in underserved areas, and accelerate digital innovations to support economic and social growth worldwide.
Telegram has rolled out a new feature aimed at enhancing user safety by flagging messages from unknown contacts.
When users receive messages from individuals outside their contact list for the first time, a detailed information page now appears.
This page includes details such as the sender’s country (determined by their phone number), their joining date on Telegram, any shared groups, and whether their account is verified.
The goal is to help users identify potential scams and impersonators more effectively.
In addition, Telegram now provides insight into when the sender last updated their username or profile picture, offering another way to detect compromised or hacked accounts.
The company has emphasised its commitment to transparency, promising “clear indicators” to distinguish official accounts, third-party verified profiles, and regular users.
Telegram Premium subscribers can now charge fees for messages received from users outside their contact list, a feature designed to reduce spam while allowing group administrators to monetise their communities.
Dubbed “Star Messages,” this new option enables users to set customisable fees for unsolicited messages.
The feature also provides flexibility, allowing certain users or members of specific groups to send messages for free.
Telegram’s Star Messages come with convenient options, such as single-tap refunds for payments, ensuring a seamless user experience.
By offering advanced controls and monetisation opportunities, the platform continues to prioritise user safety and satisfaction.
With these updates, Telegram strengthens its position as a platform focused on both user protection and innovative monetisation tools.
MTN Nigeria has strengthened its commitment to grassroots sports development following a visit to Edo State Governor, Monday Okpebholo, at the Government House in Benin City on March 5.
The visit coincided with the upcoming launch of Season 3 of MTN Champs, an athletics competition that will commence in Edo State from March 13 to 15.
The initiative highlights MTN’s dedication to nurturing young athletic talent and aligns seamlessly with Edo State’s focus on sports development.
Idowu Adesokan, General Manager of Consumer Marketing at MTN Nigeria, expressed appreciation for Edo State’s contributions to previous editions of MTN Champs and emphasized the importance of collaboration to ensure this season’s success.
Governor Okpebholo reciprocated by pledging full logistical and administrative support to make the event impactful.
Season 3 of MTN Champs is set to engage thousands of secondary school students across Nigeria, kicking off in Edo State before moving to Lagos and Uyo in subsequent weeks.
This initiative reflects MTN Nigeria’s broader vision of fostering youth empowerment and revitalizing athletics at the grassroots level.
MTN Commits $2Bn to ITU’s Partner2Connect Initiative
Telegram Introduces New Features to Address Unsolicited Messages
NIMC Warns against Using Unauthorised Websites for NIN Changes
Kaspersky Uncovers Sophisticated Deception Campaign using DeepSeek AI as Bait
Igniteher BootCamp: A Pathway to Women Empowerment and Economic Growth
Schmidt, Ex Google Chief Says AI Risky in Terrorist Hands
KongaFM Basks in Rave Reviews from Nigerians
GSMA Launches Innovation Fund to Boost AI Solutions in Emerging Markets
FG Order MDAs to Close Commercial Banks’ Accounts, Enforce TSA Policy
OpenAI CEO Rejects $97.4Bn Takeover Bid from Elon Musk
Telecom2 days agoST Team Partner Proxy Coding School to Launch Free Tech Skills Initiative
E-Business2 days agoGBB to Train Over 300 Civil Servants on Govmail
Broadcasting2 days agoNAFDAC’s Fight Against Counterfeit Drugs Reaches New Heights with Ibadan Raid
E-Business12 hours agoKaspersky Uncovers Sophisticated Deception Campaign using DeepSeek AI as Bait
News12 hours agoIgniteher BootCamp: A Pathway to Women Empowerment and Economic Growth
Telecom12 hours agoMTN Nigeria Reaffirms Support for Grassroots Sports During Edo State Visit
Telecom12 hours agoTelegram Introduces New Features to Address Unsolicited Messages
Telecom12 hours agoForeign Affairs Minister Amb. Tuggar Lauds Moniepoint as a Nigerian Fintech Success Story