CYBER THREAT ANALYSIS - CHINA - Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia

Aug 23, 2026

Upload by Oliver

Profiles trends in Chinese state-sponsored cyber espionage targeting Southeast Asian countries, identified through large-scale automated network traffic analytics and expert analysis. Draws on multiple threat-intelligence data sources including Recorded Future Platform and security-focused services. Highlights 2021 intrusions by the tracked TAG-161 (TAG-16) using custom malware families such as FunnyDream and Chinoxy, and also two suspected campaigns targeting Laos and Cambodia to support Belt and Road Initiative objectives. Includes key judgments and contextual background on regional targeting and estimated victims.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages13

Reading Time33 min

AccessFree to download

Executive Summary

Key Judgments

Background

CYBER THREAT ANALYSIS CHINA Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia CYBER THREAT ANALYSIS | CHINA This report profiles trends in Chinese state-sponsored cyber espionage activity targeting Southeast Asian countries. The activity was identified through large-scale automated network traffic analytics and expert analysis. Data sources include the Recorded Future Platform, SecurityTrails, DomainTools, PolySwarm, Farsight, Team Cymru, and common open-source tools and techniques. The research will be of most interest to individuals engaged in strategic and operational intelligence relating to the activities of Chinese military and foreign intelligence agencies in cyberspace and network defenders with a presence in Southeast Asia. Executive Summary Recorded Future’s Insikt Group tracks Chinese state-sponsored cyber espionage operations targeting government and private sector organizations across Southeast Asia. In this report, we highlight multiple examples of activity reported to Recorded Future clients throughout 2021. The identified intrusion campaigns almost certainly support key strategic aims of the Chinese government, such as gathering intelligence on countries engaged in South China Sea territorial disputes or related to projects and countries strategically important to the Belt and Road Initiative (BRI) . The activity highlighted includes a group we track as Threat Activity Group 16 (TAG-161), which has compromised several high-profile military and government organizations across Southeast Asia throughout 2021 using custom malware families such as FunnyDream and Chinoxy. Many of the governments targeted by TAG-16 are engaged in ongoing disputes with China over territorial claims in the South China Sea. Additionally, we highlight 2 separate suspected Chinese state-sponsored intrusion campaigns targeting entities in Laos and Cambodia. Both are likely intended to support BRI objectives. Victims in these 2 respective campaigns include the National Committee for Special Economic Zones (SEZs) and National Enterprise Database (NED) in Laos and Cambodia’s Sihanoukville Autonomous Port (PAS) . 1 Insikt Group publicly names a new threat activity group or campaign, such as RedFoxtrot, typically when analysts have data corresponding to at least 3 points on the Diamond Model of Intrusion Analysis with at least medium confidence. We will occasionally report on significant activity using a temporary activity clustering name such as TAG-16, where the activity is new and significant but doesn’t map to existing groupings and hasn’t yet graduated or merged into an established activity group. Key Judgments • Our research highlights China’s continued strategic and tactical interest in government and private sector organizations in Southeast Asia. This targeting is almost certainly linked to a range of objectives intended to support a deepening of regional influence, including traditional intelligence gathering against regional rivals and allies, economic intelligence gathering against BRI-linked targets, and the South China Sea disputes. • The operational tasking of TAG-16 is likely linked, in part, to gathering intelligence on South China Sea-related issues. Notably, Insikt Group identified the compromise of navies, prime minister’s offices, ministries of defense, and ministries of foreign affairs across several countries with a presence in the South China Sea. • The targeting of Cambodia’s Sihanoukville Autonomous Port and Laos’s National Committee for SEZs is likely linked to China’s wider strategic objectives under the BRI. PAS has high strategic significance given its location along the Maritime Silk Road route, while the Lao government has promoted the development of SEZs as an entry point for private sector development, including domestic and foreign direct investment (FDI) . 1 CTA-CN-2021-1208 Recorded Future® | [www. recordedfuture.c

FAQs

Which actors and organizations are targeted in the report?

The report highlights Chinese state-sponsored cyber espionage targeting government and private sector organizations across Southeast Asia, including military and foreign affairs-related entities.

What is TAG-161 (TAG-16) and what did it compromise?

TAG-161 (TAG-16) is a tracked activity group reported as compromising multiple high-profile military and government organizations across Southeast Asia during 2021 using custom malware families such as FunnyDream and Chinoxy.

How are the Laos and Cambodia campaigns linked to broader Chinese objectives?

The report describes two suspected intrusion campaigns targeting entities in Laos and Cambodia, likely intended to support Belt and Road Initiative objectives, with victims including SEZ-related organizations in Laos and Sihanoukville Autonomous Port in Cambodia.

Aug 23, 2026

Upload by Oliver