Telecom
Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds
Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.
Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.
After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.
While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.
“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.
“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.
“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.
“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”
Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.
While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.
In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.
Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.
Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.
However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.
“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.
“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.
To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).
For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.
MTN Uganda is seeking input from stakeholders on a plan to structurally separate its mobile money service, MoMo, from its core telecoms business.
According to the company, the proposed change will be discussed at the upcoming extraordinary general meeting on July 2.
If approved, the telco’s fintech business will be run by a new company controlled by MTN Group Fintech Holdings B.V. and a trust benefiting minority shareholders following a merger.
Additionally, the restructuring also aligns with MTN Group’s ambition 2025 strategy which aims to unlock value, attract new investors, and strengthen regulatory compliance by creating standalone fintech entities in Uganda, Ghana, and Nigeria.
The company’s fintech division has over 13 million customers, with an 18.4% revenue increase in the first quarter of 2025, driven by 19.0% growth in mobile money services, 19.8% growth in transaction volumes, and a 31.4% increase in transaction value.
Reports say the decision is part of the telco’s compliance with the National Payment Systems Act 2020, which mandates mobile money businesses to operate as standalone entities, and to align with MTN Group’s regional fintech strategy.
MTN Uganda, which is led by CEO Sylvia Mulinge, highlighted that the implementation of the proposed transaction will be subjected to a number of conditions and regulatory procedures.
“The implementation of the proposed transaction shall be subject to a number of conditions, including the company and MTN MoMo receiving all required regulatory approvals and no-objections and complying with any regulatory conditions,” said MTN Uganda in notice.
Netflix has announced plans to invest more than €1 billion in Spanish film and television productions over the next four years, reinforcing its commitment to Spain as a key creative hub in Europe.
The announcement was made by co-chief executive Ted Sarandos at an event held at Netflix’s production studios near Madrid, celebrating the company’s 10-year presence in the country.
Sarandos emphasized that the investment would contribute significantly to Spain’s economy, create jobs, and enable the streaming platform to produce more local content. He was joined by Spanish Prime Minister Pedro Sánchez in unveiling the initiative.
Netflix first established its international production studios in Madrid in 2019, following the success of the Spanish-language hit series Money Heist.
Since then, its 22,000-square-meter facility has become one of Netflix’s major production centers within the European Union.
The company currently supports over 20,000 jobs in Spain, highlighting the nation’s growing influence in global entertainment.
The investment reflects Netflix’s ongoing strategy to expand its presence in European markets through original content and local talent.
Nigeria Computer Emergency Response Team (ngCERT) has raised alarms over a new wave of advanced cyberattacks targeting Android mobile phones through a malware campaign dubbed Tria Stealer.
The malicious software is designed to infiltrate Android devices, hijack messaging accounts, intercept One-Time Passwords (OTPs), to steal sensitive personal and financial data.
According to ngCERT, Tria Stealer spreads primarily through deceptive tactics, such as fake event invitations distributed via popular messaging platforms like WhatsApp and Telegram.
Unsuspecting users are enticed to download an infected (APK) file, often disguised as a harmless system application, to evade detection.
Once installed, Tria Stealer requests extensive permissions, including access to SMS, call logs, and app notifications.
It immediately commences data harvesting activities, sending stolen information to a Command and Control (C2) server operated via Telegram bots.
This trojan spreads through fake links, usually disguised as wedding or event invites, and tricks users into downloading malicious APK files
“Account takeover of messaging platforms. Impersonation of victim for fraudulent money transfer requests. Compromise of banking and financial applications. Identity theft and credential harvesting.”
In plain terms, if your phone is compromised, the consequences could be catastrophic.
Your financial apps are vulnerable, your reputation could be ruined by impersonation and even simple personal messages could be twisted into tools for scams.
Here’s what users should be doing now:
Don’t download apps outside the official Play Store.
Be suspicious of random invites or links, even from people you know.
Turn on 2FA for everything—banking, emails, social platforms.
Get a reputable antivirus and keep it updated.
If you run an organisation, you should already be taking this seriously.
ngCERT’s guidance says you should raise awareness, monitor mobile devices, and not let your team click on unverified links.
“Deploy network monitoring for suspicious outbound connections to known C2 domains,” it said, meaning, keep an eye on every digital door in and out.
This isn’t one of those cases where you wait to see if it affects you. By the time you realise it, it may already be too late.
Aliko Dangote Signs out @ Dangote Sugar Refinery as Chairman
Court Declines Access Bank’s Request to Freeze MTNN Account over N180Bn Claims
FG Mulls Fibre Optic Layout to Bridge Internet Gaps
Report Reveals New Malware Posing as an AI Assistant Steals User Data
MTN Mulls Establishment of Fintech Firm in Nigeria, Others
News2 days agoCDCFIB Warns against Recruitment Racketeers
Telecom2 days agoMeta, FMCIDE Unveil AI Accelerator to Drive Innovation in Nigeria
News2 days agoFG May Forfeits $4m from World Bank Loan over Audit Flop
Telecom2 days agoNigeria Leads the Charge in Green Innovation @MTN’s Africa PachiPanda Challenge
Broadcasting2 days agoAfia TV and Radio Stamps Footprints in Lagos
E-Financial2 days agoNDIC Begins Final Settlements to Creditors of Liquidated Premier Bank
Telecom1 day agongCERT Issues High Alert to Nigerians Using Android Phones
Telecom2 days agoZinox Technologies Collaborates with FGN for VivaTech Paris 2025