SteppeDriver

Summary

China-aligned espionage group ESET discovered in December 2024 while investigating the compromise of a locally owned business in France. It has also targeted Mongolian government entities and a South American law firm, using a broad toolset — ShadowPad, CoolClient, CurlyDoor, RudeGull and MKTDownloader — much of which is shared across China-aligned groups. On 5 February 2026 it deployed a proxy tool in a Mongolian government network and on 17 February 2026 the CoolClient backdoor on a machine in a Syrian government network — an unusual target that ESET links to Beijing's interest in Syria's reconstruction and in Uyghur fighters there. Single-vendor reporting.

Attribution

No service publicly named

Assessed by security researchers or MITRE ATT&CK; no government attribution on record.

• ESET Research (Research, 2026-05-28)
  China-aligned espionage group

Campaigns 2

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 3

Malware and tools 5

Reporting and advisories 1

• ESET APT Activity Report Q4 2025–Q1 2026
  Mongolian and Syrian government networks — CoolClient and a shared proxy tool