The observed activity, which SentinelOne’s SentinelLabs tracks as Moshen Dragon, partially overlaps with the threat actor known as Calypso, RedFoxtrot, and Nomad Panda, which has been actively targeting entities in South Asia with known malware families.
As part of the observed attacks, which targeted the telecommunications sector in the region, the adversary employed tools, techniques, and procedures (TTPs) commonly associated with Chinese hackers, and also abused cybersecurity solutions for malware execution.
