Chinese State-Sponsored Cyber Espionage Intensifies in Southeast Asia

Executive Summary

Chinese state-sponsored cyber actors have escalated their operations in Southeast Asia, focusing on government entities, critical infrastructure, and diplomatic targets. Utilizing advanced malware, supply chain compromises, and SIGINT-linked intrusions, these actors aim to collect sensitive information and maintain prolonged access to targeted networks.

Long-Term Espionage Implants

Since mid-2024, a Chinese state-sponsored group, identified as Silver Dragon, has been conducting cyber-espionage campaigns targeting government entities in Southeast Asia and Europe. This group employs sophisticated techniques to evade detection, embedding malware within legitimate services such as Google Drive and core Windows components like Windows Update and .NET utilities. Their custom backdoor, GearDoor, uses Google Drive for command-and-control operations, disguising communication as regular file uploads and downloads. Infection often begins via phishing emails or exploiting internet-facing systems. By hiding within normal system activity and leveraging trusted platforms, the group effectively evades traditional perimeter defenses and prolongs their presence within affected networks. (techradar.com)

Supply Chain Compromise for Intelligence Collection

Chinese state-sponsored cyber espionage campaigns have been primarily targeting Malaysia, Indonesia, and Vietnam, as well as the Philippines, Laos, Cambodia, and Thailand. The operations appear to support China's Belt and Road Initiative, aiming to gather intelligence on countries engaged in South China Sea territorial disputes or related to projects and countries strategically important to the Belt and Road Initiative (BRI). (thecyberwire.com)

SIGINT-Linked Intrusions

In August 2025, Google reported that diplomats in Southeast Asia were targeted in a cyber-espionage campaign likely waged in support of operations aligned with the strategic interests of China. The attacks, using social engineering and malware disguised as innocuous software updates, were attributed to the China-linked UNC6384 group. (bloomberg.com)

Diplomatic Targeting

In August 2025, Google reported that diplomats in Southeast Asia were targeted in a cyber-espionage campaign likely waged in support of operations aligned with the strategic interests of China. The attacks, using social engineering and malware disguised as innocuous software updates, were attributed to the China-linked UNC6384 group. (bloomberg.com)

Conclusion

The increasing sophistication and persistence of Chinese state-sponsored cyber espionage activities in Southeast Asia pose significant threats to regional security and stability. The use of advanced malware, supply chain compromises, and SIGINT-linked intrusions underscores the need for enhanced cybersecurity measures and international cooperation to mitigate these risks.

Highlights:

• Chinese hackers hide malware within Windows and Google Drive to hit government targets, Published on Thursday, March 05