ChinaAssessedChina-alignedEspionageActive 2025 – 2026NegativeGlimmer
Summary
China-aligned espionage group ESET named in its Oct 2025–Mar 2026 reporting. In December 2025 it targeted a Cambodian government entity with LNK lures referencing CNOOC (China National Offshore Oil Corporation), side-loading a Cobalt Strike loader through a legitimate Visual Studio component; in January 2026 the same loader hit an AI and robotics company in South Korea, matching Beijing's Made in China 2025 technology priorities; it also compromised government entities in Panama. ESET finds overlaps with Unit 42's TGR-STA-1030 that support a medium-confidence claim the two are related — not that they are the same actor. Single-vendor reporting.
Attribution
No service publicly named
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- ESET Research (Research, 2026-05-28)
Reported among China-aligned actors; overlaps TGR-STA-1030 (medium confidence)
Campaigns 1
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Cambodian government (CNOOC-themed LNK lures), South Korean AI/robotics company and Panamanian government | 2025-12 – 2026-01 | Cambodia, South Korea, Panama | Government, Technology | ESET APT Activity Report Q4 2025–Q1 2026 (2026-05-28) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 4
| Initial Access1 | T1566.001Spearphishing Attachment |
|---|---|
| Execution2 | T1204.002Malicious FileT1059.001PowerShell |
| Stealth1 | T1574.001DLL |
Malware and tools 2
| Name | Description | Platform |
|---|---|---|
| Cobalt Strike | Commercial C2 framework (loader via side-loading) | Windows |
| AdaptixC2 | Open-source C2 framework | Windows |
Reporting and advisories 1
- ESET APT Activity Report Q4 2025–Q1 2026
Cambodian government (CNOOC-themed LNK lures), South Korean AI/robotics company and Panamanian government