Check Point Reports China-Linked Campaign Targeting Qatar With Backdoors
Summary
Check Point Research reports that China-linked actors, including Camaro Dragon, targeted Qatar’s military and energy sectors with conflict-themed lures delivering PlugX and Cobalt Strike through Baidu NetDisk DLL hijacking and an NVDA-component Rust loader.
Key points
- Check Point Research says the activity began on March 1, 2026, one day after the launch of Operation Epic Fury.
- Lures included fake photos and crisis headlines designed to appear relevant to the regional conflict.
- One infection chain reportedly contacted a compromised server and used DLL hijacking in Baidu NetDisk to deploy PlugX.
- The article says PlugX can be used to steal files, log keystrokes, and capture screen images.
- A password-protected archive targeting energy-sector organizations reportedly contained a Rust loader concealed in NVDA components, with Cobalt Strike as the final payload.
- Researchers noted that Camaro Dragon had used the same decryption key and method against the Turkish military in late December.
- The article separately reports that MuddyWater targeted U.S. and Israeli organizations with a malware strain researchers call DinDoor.
Article Details
- Event Type
- Reported targeted cyberespionage campaign against Qatar using conflict-themed lures and backdoors.
- Impact
- Check Point Research reported that China-linked actors, including Camaro Dragon, targeted Qatar’s military and energy sectors. The reported infection chains deployed PlugX for file theft and surveillance and sought to install Cobalt Strike in energy-sector networks. Separately, MuddyWater was reported targeting U.S. and Israeli organizations with DinDoor.
Threat Actors
Camaro DragonCheck Point Research reported that this China-linked group targeted Qatar with conflict-themed lures and malware, including PlugX; the article also says researchers observed the same method used against the Turkish military earlier.MuddyWaterThe article describes MuddyWater as Iranian-linked and says researchers recently observed it targeting U.S. and Israeli organizations with DinDoor.
Malware
DinDoorOther state-linked groups like MuddyWater were also active, deploying a new strain dubbed DinDoor against U.S.PlugXCheck Point Research found China-linked hackers, including the Camaro Dragon group, targeting Qatar with conflict-themed lures that deliver backdoors like PlugX and loaders that lead to Cobalt Strike deployment.
Products
Baidu NetdiskThe campaign abuses DLL hijacking in Baidu NetDisk and hides a Rust-written loader inside NVDA components to hit Qatar’s military and energy sectors during heightened regional tensions.NVDAThe campaign abuses DLL hijacking in Baidu NetDisk and hides a Rust-written loader inside NVDA components to hit Qatar’s military and energy sectors during heightened regional tensions.
Tools
Countries
ChinaCheck Point Research found China-linked hackers, including the Camaro Dragon group, targeting Qatar with conflict-themed lures that deliver backdoors like PlugX and loaders that lead to Cobalt Strike deployment.IranAlthough the situation largely affects Iran, Iranian-linked hackers from MuddyWater were recently spotted targeting U.S.QatarCheck Point Research found China-linked hackers, including the Camaro Dragon group, targeting Qatar with conflict-themed lures that deliver backdoors like PlugX and loaders that lead to Cobalt Strike deployment.United StatesOther state-linked groups like MuddyWater were also active, deploying a new strain dubbed DinDoor against U.S.
Industries
EnergyThe campaign abuses DLL hijacking in Baidu NetDisk and hides a Rust-written loader inside NVDA components to hit Qatar’s military and energy sectors during heightened regional tensions.MilitaryThe campaign abuses DLL hijacking in Baidu NetDisk and hides a Rust-written loader inside NVDA components to hit Qatar’s military and energy sectors during heightened regional tensions.