--- title: Chinese Cyber Threat Lurks In Critical Asian Sectors for... description: Palo Alto Networks' Unit 42 has documented a Chinese-speaking threat cluster, CL-UNK-1068, conducting cyberespionage against critical infrastructure sectors... canonical: https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chinese Cyber Threat Lurks In Critical Asian Sectors for Years | daily.dev og:description: Palo Alto Networks' Unit 42 has documented a Chinese-speaking threat cluster, CL-UNK-1068, conducting cyberespionage against critical infrastructure sectors... og:url: https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv og:image: https://api.daily.dev/og/posts/8FWvGxFSV.png og:image:alt: Chinese Cyber Threat Lurks In Critical Asian Sectors for Years og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chinese Cyber Threat Lurks In Critical Asian Sectors for Years **[Dark Reading](https://daily.dev/sources/dr)** · 4 min read · 0 upvotes · 0 comments ## Summary Palo Alto Networks' Unit 42 has documented a Chinese-speaking threat cluster, CL-UNK-1068, conducting cyberespionage against critical infrastructure sectors across South, Southeast, and East Asia since at least 2020. Targets include aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications organizations. The group uses a mix of custom malware (including a Go-based port scanner called ScanPortPlus), open source tools, web shells (GodZilla, AntSword), credential-dumping tools (Mimikatz, LsaRecorder, DumpIt), and living-off-the-land binaries across both Windows and Linux. Persistence is maintained via DLL side-loading through Python executables, modified Fast Reverse Proxy builds, and the Xnote Linux backdoor. Unit 42 recommends defenders watch for misuse of Python binaries, unauthorized tunneling tools, credential-dumping activity, unusual RAR/Base64 encoding, and web shell deployments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [An Investigation Into Years of Undetected Operations Targeting High-Value Sectors](https://daily.dev/posts/an-investigation-into-years-of-undetected-operations-targeting-high-value-sectors-y5ptdykz6) · Unit 42 · 0 upvotes · 0 comments - [Chinese Hackers Owned Southeast Asian Military Orgs for Years](https://daily.dev/posts/chinese-hackers-owned-southeast-asian-military-orgs-for-years-6twaxiz2m) · Dark Reading · 0 upvotes · 0 comments - [Suspected China-Based Espionage Operation Against Military Targets in Southeast Asia](https://daily.dev/posts/suspected-china-based-espionage-operation-against-military-targets-in-southeast-asia-gqascxcy9) · Unit 42 · 0 upvotes · 0 comments - [Chinese spy group caught lurking in Poland, Asia networks](https://daily.dev/posts/chinese-spy-group-caught-lurking-in-poland-asia-networks-9camnlgtt) · The Register · 1 upvotes · 0 comments - [Chinese hackers target telcos with new Linux, Windows malware](https://daily.dev/posts/chinese-hackers-target-telcos-with-new-linux-windows-malware-ql0h0a4gw) · BleepingComputer · 2 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chinese Cyber Threat Lurks In Critical Asian Sectors for Years","url":"https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv"},"datePublished":"2026-03-09T14:30:36.220Z","dateModified":"2026-03-09T14:31:07.566Z","description":"Palo Alto Networks' Unit 42 has documented a Chinese-speaking threat cluster, CL-UNK-1068, conducting cyberespionage against critical infrastructure sectors...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c6ffd5c68213e09d88bb6ca2ac70409?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/0c6ffd5c68213e09d88bb6ca2ac70409?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Dark Reading","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Dark Reading","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/dr","url":"https://daily.dev/sources/dr"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chinese-cyber-threat-lurks-in-critical-asian-sectors-for-years-8fwvgxfsv","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Dark Reading","item":"https://daily.dev/sources/dr"},{"@type":"ListItem","position":3,"name":"Chinese Cyber Threat Lurks In Critical Asian Sectors for Years"}]} ```