PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats

A sophisticated cyber espionage campaign attributed to the PRC-nexus threat actor UNC6384 targeted diplomats in Southeast Asia and other global entities. The attack chain involved hijacking web traffic through a captive portal redirect to deliver malware disguised as software updates. The multi-stage attack utilized advanced social engineering, adversary-in-the-middle techniques, and evasion tactics. The malware payload, SOGU.SEC backdoor, was deployed through a digitally signed downloader (STATICPLUGIN) and a side-loaded DLL (CANONSTAGER). The campaign demonstrated the evolving capabilities of PRC-nexus threat actors, employing stealthy tactics to avoid detection and leveraging legitimate Windows features for malicious purposes.

• CVE-2026-102764: Critical BeyondTrust Remote Support Authentication Bypass Exploited in the WildExploitedVulnerability2026-10-20
• Fake Calendly "Meta Careers" pages steal Facebook and Google loginsCampaign2026-10-14
• Case of AgentTesla Malware Distribution Disguised as a Business Proposal EmailMalware2026-10-14
• RSVP to Disaster: How One Click Installs a RATMalware2026-10-13
• Inside a brand deal scam targeting YouTube creatorsCampaign2026-10-12