Cyber threats / Threat actors

CL-STA-0048

CN Suspected sponsor: China
0
APAC targets
0
Techniques
0
Incidents
0
News · 30d
Profile
Also known as: CL STA 0048

CL-STA-0048 is a Chinese state-backed APT that targets strategic sectors in South Asia, particularly government and telecommunications entities, with a focus on espionage. The group has been linked to SAP NetWeaver intrusions and employs techniques such as DNS beaconing using ping commands and exploiting unpatched vulnerabilities in services like IIS, Apache Tomcat, and MSSQL. Analysts have observed its use of reverse shell commands and command-and-control traffic directed to specific IP addresses. The actor adapts its methods to evade detection and maintain persistent access to high-value networks.

ATT&CK techniques
MITRE ATT&CK has no technique mapping for this actor.
Incidents attributed
  • No incident in the register is attributed to this actor.
In the news
  • No Asia-Pacific article names this actor yet.
Targets
No victim countries in the sources.
Relevance to the EU
EU relevance: Low
No EU member state among its known victims and no overlap with EU projects
No EU cooperation projects recorded in its target countries.
References
Sources: MISP