Myanmar Cyber Review Finds a Decade of Risks to Trusted Systems and Digital Identity
Summary
A public-source review of Myanmar-linked cyber records from 2016 to 2026 finds recurring risks to trusted channels, identities, and institutional data, while stressing that selected reports cannot establish national incident prevalence or confirm every attribution.
Key points
- The review covers selected public-source records through September 1, 2026, and cautions that they do not measure national incident prevalence.
- Reported cases include malware on government-associated infrastructure, website defacement, access-control weaknesses, data exposures, cyberespionage, and online fraud.
- A 2022 technical observation described Myanmar-related material staged on temporary infrastructure, including documents, browser credentials, tokens, and session cookies; the final destination was unknown.
- A 2025 investigation described modular tools and DLL side-loading, but its starting sample of two machines does not establish countrywide prevalence.
- The review distinguishes direct technical observations and official acknowledgements from secondary reporting, analytical assessments, and suspected attribution.
- It recommends securing trusted publishing paths, strengthening identity and session controls, testing record-level authorization, monitoring software loading, and preserving evidence.
Article Details
- Publisher
- Malware Info
- Report Period
- 2016–2026; research cutoff 2026-09-01
- Scope
- Selected public-source reporting on cyber events connected to Myanmar; not a national incident count or prevalence estimate.
- Sample Size
- 14 chart-eligible selected records.
- Key Statistics
- The review includes 14 chart-eligible records; selection and publication history do not indicate national incident prevalence.
- A 2021 data-collection claim described 330.5 GB associated with roughly 120,000 companies; the review did not obtain or validate the data.
- The 2025 Zscaler investigation began with two machines at an organization in Myanmar; this does not establish countrywide prevalence.
- PTD's annual series recorded active mobile subscriptions increasing from 44.56 million in 2016 to 77.48 million in 2020; subscriptions are not unique people or a measure of cyber incidents.
- Recommendations
- Protect trusted publishing paths with change monitoring, version history, controlled publishing access, and verifiable hashes or signatures where practical.
- Harden identity controls and include session and token revocation, mailbox-rule review, and identity-provider log review in response playbooks.
- Test public-service portals for authorization on every requested record and action without accessing real users' records without authority.
- Monitor DLL loading relationships, including the process, module path, signer, hash, and subsequent behavior.
- Plan for lawful, evidence-preserving collection of endpoint, memory, cloud-audit, and network records, with appropriate controls for sensitive data.
MITRE ATT&CK
T1056.001 · KeyloggingThe 2025 investigation described keylogging capability.T1491.002 · External DefacementGovernment websites reportedly displayed altered content in the 2017 defacement incidents.T1539 · Steal Web Session CookieThe 2022 observation included collection of session cookies and tokens.T1555.003 · Credentials from Web BrowsersReporting described collection of stored browser credentials and browser-login data.T1574.002 · DLL Side-LoadingReports describe DLL side-loading in the 2021 loader incident and in 2025 and 2026 campaign reporting.
Threat Actors
BlueNoroffKaspersky's 2019 review separately reported a Myanmar bank compromised by BlueNoroff.HoneyMyteKaspersky reported Myanmar government-sector targeting in 2019 and new campaigns including Myanmar targeting in 2026.Mustang PandaResearchers linked a 2022 temporary distribution and storage server to Mustang Panda; 2024 reporting described the group as suspected in targeting ministries.
Malware
CoolClientThe publication described CoolClient variants, browser-login data stealers, DLL side-loading, backdoors, and reconnaissance scripts across several countries and campaigns.CorKLOGIn a two-part April 2025 investigation, Zscaler ThreatLabz documented ToneShell and StarProxy and PAKLOG, CorKLOG, and SplatCloak.PAKLOGIn a two-part April 2025 investigation, Zscaler ThreatLabz documented ToneShell and StarProxy and PAKLOG, CorKLOG, and SplatCloak.SplatCloakIn a two-part April 2025 investigation, Zscaler ThreatLabz documented ToneShell and StarProxy and PAKLOG, CorKLOG, and SplatCloak.StarProxyIn a two-part April 2025 investigation, Zscaler ThreatLabz documented ToneShell and StarProxy and PAKLOG, CorKLOG, and SplatCloak.TONESHELLIn a two-part April 2025 investigation, Zscaler ThreatLabz documented ToneShell and StarProxy and PAKLOG, CorKLOG, and SplatCloak.TrochilusThe report connected material to its UP007 investigation and discussed a Trochilus-linked sample described by ASERT.
Tools
Countries
Industries
Civil societyGovernment and government-adjacent organizations appear frequently in the selected record, followed by finance, diplomacy, civil society, health, elections, and business-registration contexts.DiplomacyGovernment and government-adjacent organizations appear frequently in the selected record, followed by finance, diplomacy, civil society, health, elections, and business-registration contexts.Governmentinternational bodies, and affected organizations describes a varied record: malware hosted on trusted government infrastructure, website defacement, access-control failures, exposed institutional records, targetedTelecommunicationsTelecommunications context: expanding connectivity, not a risk score