ChinaAssessedChina-alignedEspionageActive 2025 – 2026TA419
Summary
China-aligned, espionage-motivated actor that Proofpoint has tracked since at least April 2025 and first described publicly on 1 October 2026. It runs regular credential-phishing campaigns against people at US- and Japan-based think tanks, defence contractors, universities and law firms, opening with benign rapport-building emails from impersonated experts (T1566.002) — in July 2026 a former White House OSTP deputy director and a prominent economist, in February 2026 a senior Anthropic employee — before sending a shortened link (T1608.005) through Cloudflare-fronted redirectors to an adversary-in-the-middle Microsoft 365 phishing page built on the open-source Frameless BitB kit with an Evilginx phishlet (T1557). The kit captures session cookies (T1539) and its custom telemetry script auto-submits one-time codes. Domains are file-sharing-themed or impersonate specific organisations (T1583.001), such as the Japan-Taiwan Exchange Association and the Heritage Foundation.
Attribution
Proofpoint assessment; first public reporting Oct 2026; no government attribution
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Proofpoint (Research, 2026-10-01)
China-aligned, espionage-motivated actor tracked since April 2025
Campaigns 2
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Impersonated AI-policy experts — AitM Microsoft 365 phishing of US think tanks, universities and law firms | 2026-07 | USA | Think Tanks, Academia, Legal | Proofpoint (2026-10-01) — from 8 Jul 2026 |
| Fake Anthropic employee lure against a US think-tank AI policy analyst | 2026-02 | USA | Think Tanks | Proofpoint (2026-10-01) |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 5
| Resource Development2 | T1608.005Link TargetT1583.001Domains |
|---|---|
| Initial Access1 | T1566.002Spearphishing Link |
| Credential Access2 | T1557Adversary-in-the-MiddleT1539Steal Web Session Cookie |
Malware and tools 1
| Name | Description | Platform |
|---|---|---|
| Frameless BitB (customised) | AitM phishing kit (open source, modified) | web |
Infrastructure patterns
- File-sharing-themed domains registered via NameSilo and fronted by Cloudflare (Proofpoint, 2026)
- Lookalike domains for targeted bodies, e.g. tw-koryu[.]org, heritiages[.]org, shinjirou[.]info (Proofpoint, 2026)
- Sending VPSs share one self-signed TLS cert on a high port, likely a covert network (Proofpoint, 2026)