Asia-based cyberespionage campaign breaches governments worldwide and expands reconnaissance

Palo Alto Networks Unit 42 reports an Asia-based cyberespionage group compromised at least 70 institutions across 37 governments and conducted reconnaissance in 155 countries. The attackers used phishing to drop a Cobalt Strike payload and a mix of exploits to gain footholds, with some victims accessed for months (including a parliament and key ministries). The operation is described as potentially the most widespread state-sponsored government breach since SolarWinds, with the group adapting to different targets and events and attribution to a specific country not determined.