CHINA-LINKED ESPIONAGE TOOLS USED IN RANSOMWARE ATTACKS

Summary from the TLDR InfoSec newsletter

A China-linked threat actor, previously known for espionage activities using the PlugX backdoor, conducted a ransomware attack against a South Asian software company in late 2024, demanding up to $2 million in ransom. The attack utilized the same toolset seen in earlier espionage campaigns, including a malicious DLL sideloaded through a legitimate Toshiba executable, which was linked to the Fireant (aka Mustang Panda) espionage group. While several theories were proposed for this unusual combination of espionage and ransomware activity, Symantec notes that the most likely explanation is that an individual actor was attempting to profit personally using their employer's toolkit.