According to cybersecurity company Sophos, a suspected China-based cyber espionage campaign called "Operation Crimson Palace" is expanding its operations to additional countries. The campaign began in 2023 and is made up of three attack groups whose activity is managed by China's Ministry of State Security. The group's activity ceased in August 2023, but has recently resumed using a previously undocumented keylogger. The group uses open-source tools like Cobalt Strike (for command and control [C2 or C&C]), SharpHound (for reconnaissance), Impacket (for lateral movement), Donut (a shellcode loader), Cloudflare tunnel (also for C2 work),