Malware
MemFun
- First Reported
- Mar 13, 2026
- Latest Reported
- Mar 16, 2026
Reported Context (4)
- As part of the observed intrusions, the hackers deployed custom tools, such as the AppleChris and MemFun backdoors and the Getpass credential stealer, and executed malicious PowerShell scripts remotely on multiple Palo Alto Networks Details China-Linked Espionage Campaign Targeting Southeast Asian Militaries
- The actors deployed custom backdoors AppleChris and MemFun, a Mimikatz-derived credential harvester Getpass, and used Dead Drop Resolvers via Pastebin and Dropbox for resilient C2 infrastructure. Unit 42 Details Suspected China-Nexus Espionage Campaign Targeting Southeast Asian Military
- The operators deployed custom backdoors AppleChris and MemFun, a credential harvester Getpass, and Pastebin/Dropbox-based C2 resolution while using DLL hijacking, process hollowing, delayed execution, and other evasion Unit 42 Details CL-STA-1087 Espionage Campaign Targeting Southeast Asian Militaries
- The group practices strategic operational patience and uses custom tools like AppleChris, MemFun, and Getpass to target C4I systems and harvest highly specific military intelligence. Unit 42 Details CL-STA-1087 Espionage Campaign Targeting Southeast Asian Militaries
Malware (2)
People (2)
Threat Actors (1)
MITRE ATT&CK (23)
Vendors (1)
Products (4)
Tools (1)
Industries (1)
Countries (1)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.