CL-STA-0969 INSTALLS COVERT MALWARE IN TELECOM NETWORKS DURING 10-MONTH ESPIONAGE CAMPAIGN

Summary from the TLDR InfoSec newsletter

Chinese state-sponsored threat actor CL-STA-0969 conducted a 10-month espionage campaign that targeted Southeast Asian telecom networks. The campaign used custom malware, including AuthDoor, GTPDOOR, and ChronosRAT, to enable remote control and location tracking. The group deployed advanced evasion techniques, including DNS tunneling and traffic routing through compromised mobile operators, while maintaining high operational security. There was no evidence of data exfiltration despite the attackers installing multiple backdoors and scanning tools across critical telecommunications infrastructure.