Threat Research · thehackernews.com

Unit 42 Details CL-STA-1087 Espionage Campaign Targeting Southeast Asian Militaries

Mar 14, 2026 · Original article ↗

Summary

Unit 42 reports that suspected China-based operators have targeted Southeast Asian military organizations since at least 2020, using AppleChris, MemFun, and Getpass for stealthy access and targeted intelligence collection.

Key points

Unit 42 tracks the suspected state-sponsored campaign as CL-STA-1087; the initial access vector remains unknown.
The operators sought intelligence on C4I systems, military structures, and joint activities rather than bulk data theft.
The toolkit includes AppleChris and MemFun backdoors and Getpass, a custom Mimikatz variant used to seek passwords and NTLM hashes from LSASS memory.
AppleChris and MemFun retrieve C2 details through Pastebin; one AppleChris variant can use Dropbox as a fallback.
MemFun uses a multi-stage, runtime-delivered payload chain, while its dropper uses process hollowing to run code in a suspended dllhost.exe process.
Reported evasion methods include DLL hijacking, delayed execution, anti-forensic checks, and dormant access lasting months.

Article Details

Attack Vectors: The initial access vector is unknown.
AppleChris was launched via DLL hijacking; variants were deployed across target endpoints following lateral movement.
MemFun used a multi-stage chain in which a loader injected shellcode that launched an in-memory downloader.
MemFun used process hollowing to inject its main payload into a suspended process associated with dllhost.exe.
A PowerShell script entered a six-hour sleep state before creating reverse shells to a threat actor-controlled C2 server.
AppleChris and MemFun retrieved C2 address information from Pastebin; one AppleChris version used Dropbox as a fallback.
Getpass attempted to extract plaintext passwords and NTLM hashes from lsass.exe process memory.
Defensive Notes: Monitor for PowerShell execution followed by unusually long sleep intervals and reverse-shell activity.
Investigate DLL hijacking and process hollowing involving suspended processes associated with dllhost.exe.
Review endpoint and network activity for malware retrieving C2 configuration through Pastebin or Dropbox.
Monitor access to lsass.exe memory and attempts to collect plaintext passwords or NTLM hashes.

MITRE ATT&CK

T1003.001 · LSASS MemoryGetpass attempted to extract plaintext passwords and NTLM hashes from lsass.exe process memory.T1055.012 · Process HollowingMemFun injected its main payload into a suspended process associated with dllhost.exe using process hollowing.T1057 · Process DiscoveryAppleChris could enumerate processes.T1059.001 · PowerShellA PowerShell script slept for six hours before creating reverse shells to a threat actor-controlled C2 server.T1083 · File and Directory DiscoveryAppleChris could enumerate drives and list directories, and the operators searched for files concerning military capabilities and organizational structures.T1102.001 · Dead Drop ResolverAppleChris and MemFun used Pastebin as a dead drop resolver to retrieve Base64-encoded C2 addresses; one AppleChris version also used Dropbox as a fallback.T1105 · Ingress Tool TransferMemFun retrieved a DLL from its C2 server at runtime for execution.T1497.003 · Time Based ChecksSome malware variants used sleep timers of 30 seconds for EXE files and 120 seconds for DLLs to outlast automated sandbox monitoring windows.T1574 · Hijack Execution FlowAppleChris was launched through DLL hijacking; the article does not specify the particular hijacking method.

People

Lior RochbergerUnit 42 security researcher quoted describing the cluster's targeted intelligence collection.Yoav ZemahUnit 42 security researcher quoted describing the cluster's targeted intelligence collection.

Threat Actors

CL-STA-1087Palo Alto Networks Unit 42 tracks this cluster as a suspected China-based, state-sponsored espionage operation targeting Southeast Asian military organizations since at least 2020.

Malware

AppleChrisThe operators deployed custom backdoors AppleChris and MemFun, a credential harvester Getpass, and Pastebin/Dropbox-based C2 resolution while using DLL hijacking, process hollowing, delayed execution, and other evasion GetpassThe operators deployed custom backdoors AppleChris and MemFun, a credential harvester Getpass, and Pastebin/Dropbox-based C2 resolution while using DLL hijacking, process hollowing, delayed execution, and other evasion MemFunThe operators deployed custom backdoors AppleChris and MemFun, a credential harvester Getpass, and Pastebin/Dropbox-based C2 resolution while using DLL hijacking, process hollowing, delayed execution, and other evasion

Vendors

Palo Alto NetworksPalo Alto Networks Unit 42 says a suspected China-based, state-sponsored espionage campaign tracked as CL-STA-1087 has targeted Southeast Asian military organizations since at least 2020, focusing on precise

Products

Microsoft Windows“These variants trigger delayed execution through sleep timers of 30 seconds (EXE) and 120 seconds (DLL), effectively outlasting the typical monitoring windows of automated sandboxes.”PowerShellThe cybersecurity vendor said it detected the intrusion set after identifying suspicious PowerShell execution, allowing the script to enter into a sleep state for six hours and then create reverse shells to a threat

Tools

MimikatzAlso put to use in the attacks is a custom version of Mimikatz known as Getpass that escalates privileges and attempts to extract plaintext passwords, NTLM hashes and authentication data directly from the “lsass.exe”

Countries

ChinaPalo Alto Networks Unit 42 says a suspected China-based, state-sponsored espionage campaign tracked as CL-STA-1087 has targeted Southeast Asian military organizations since at least 2020, focusing on precise

Industries

MilitaryChina-based, state-sponsored espionage campaign tracked as CL-STA-1087 has targeted Southeast Asian military organizations since at least 2020, focusing on precise intelligence collection rather than bulk theft.

Related Articles