China-linked hackers target cybersecurity firms, governments in global espionage campaign – Source: www.csoonline.com

China-linked threat actors — particularly groups tied to advanced cyber-espionage campaigns, such as PurpleHaze and ShadowPad — are targeting top-tier organizations and cybersecurity vendors in an ongoing operation.

SentinelOne, too, has attributed the PurpleHaze and ShadowPad activity clusters with high confidence to China-nexus threat actors. It also loosely linked some of PurpleHaze intrusions to actors associated with Chinese cyber-espionage groups such as APT15 and UNC5174.

Government entity breached twice in months

Activity clusters from June 2024 to March 2025, as tracked by SentinelOne, involved ShadowPad, a modular backdoor obfuscated using the ScatterBrain technique, and affected a South Asian government entity, as well as numerous corporate victims worldwide. The specific activity cluster, which involved intrusion into this entity, was observed in June 2024.

In October 2024, however, the same entity was re-compromised in a different cluster using “GOREshell” tools (reverse SSH variants) and ORB relay infrastructures linked to APT15. The infrastructure used in this cluster overlapped with other parallel campaigns, SentinelOne attributes to PurpleHaze.

Deployed PurpleHaze for broader espionage

Researchers reported that in October 2024, they detected and mitigated a reconnaissance operation targeting SentinelOne, which they identified as part of a broader activity cluster known as PurpleHaze.

As noted earlier, this PurpleHaze activity shared infrastructure with the campaign behind the re-compromise of the South Asian government entity, suggesting a stronger connection, or collaboration, between three seemingly distinct threat campaigns, all aligned with Chinese espionage operations.

“The PRC’s consistent use of advanced tradecraft and strategic targeting of security vendors like SentinelOne is not surprising; it is an extension of their broader cyber-espionage doctrine, where compromising trusted nodes provides disproportionate leverage in downstream operations,” said Heath Renfrow, CISO and Co-founder at Fenix24.

Defenders are high-value targets, especially those with access to proprietary security tooling, threat intelligence, and client infrastructure, Renfrow added.

Another key activity from the PurpleHaze campaign included the intrusion into a leading European media organization in September 2024, SentinelOne added.

SentinelOne has shared a list of SHA Hashes, URLs, Domains, and IP Addresses as indicators of compromise (IOCs) for security teams to set detection for. An overall proactive approach with focused monitoring of the internet-facing assets is recommended to government and critical infrastructure organizations. “What’s needed is vigilance, strong defenses, and information sharing–both at the general awareness and specific TTP/IOC level,” BugCrowd’s Casey Ellis said, commenting on SentinelOne’s discovery.