← Back to Pulse Feed
PULSE DETAIL
PULSE NAME
PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats | Google Cloud Blog
Google has identified and identified a Chinese government-backed cyber espionage campaign that targeted diplomats in Southeast Asia in March 2025 and is likely to have been carried out by a PRC-nexus threat actor.
MITRE ATT&CK & Malware Families
Indicators of Compromise (26)
| TYPE | INDICATOR | DESCRIPTION | CREATED | |
|---|---|---|---|---|
| FileHash-MD5 | 00c9a545c4fd77c19a490f5637025f3f | MD5 of 3299866538aff40ca85276f87dd0cefe4eafe167bd64732d67b06af4f3349916 | 2025-08-27 | |
| FileHash-MD5 | 0538e73fc195c3b4441721d4c60d0b96 | MD5 of 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3 | 2025-08-27 | |
| FileHash-MD5 | 42edaf7ea36a17c9c96465fe68c15dcd | MD5 of d1626c35ff69e7e5bde5eea9f9a242713421e59197f4b6d77b914ed46976b933 | 2025-08-27 | |
| FileHash-MD5 | 52f42a40d24e1d62d1ed29b28778fc45 | MD5 of 65c42a7ea18162a92ee982eded91653a5358a7129c7672715ce8ddb6027ec124 | 2025-08-27 | |
| FileHash-MD5 | df4a0fa496e7971e9a5fa481dfb83725 | MD5 of cc4db3d8049043fa62326d0b3341960f9a0cf9b54c2fbbdffdbd8761d99add79 | 2025-08-27 | |
| FileHash-MD5 | f24fe0e35630a1d278e0b617ba1b94cb | MD5 of c8744b10180ed59bf96cf79d7559249e9dcf0f90 | 2025-08-27 | |
| FileHash-MD5 | fa71d60e43da381ad656192a41e38724 | MD5 of e787f64af048b9cb8a153a0759555785c8fd3ee1e8efbca312a29f2acb1e4011 | 2025-08-27 | |
| FileHash-SHA1 | 080d8e82afed9237e368e1bb466437d75c9c842b | SHA1 of d1626c35ff69e7e5bde5eea9f9a242713421e59197f4b6d77b914ed46976b933 | 2025-08-27 | |
| FileHash-SHA1 | 1ab2cda09723168e6a595402901a401e5f052e9f | SHA1 of 65c42a7ea18162a92ee982eded91653a5358a7129c7672715ce8ddb6027ec124 | 2025-08-27 | |
| FileHash-SHA1 | 31ece4baeea8a6c94dd6b5cfa27b1a23b197ebdd | SHA1 of e787f64af048b9cb8a153a0759555785c8fd3ee1e8efbca312a29f2acb1e4011 | 2025-08-27 | |
| FileHash-SHA1 | 6451769fb0612bd9bae9e1d3f5f4e89f2e12a083 | SHA1 of cc4db3d8049043fa62326d0b3341960f9a0cf9b54c2fbbdffdbd8761d99add79 | 2025-08-27 | |
| FileHash-SHA1 | 907edc808da7c5feb175e9aa5dca3aed934a1331 | SHA1 of 3299866538aff40ca85276f87dd0cefe4eafe167bd64732d67b06af4f3349916 | 2025-08-27 | |
| FileHash-SHA1 | baa569318144905563b469a5a006ad54eb616a02 | SHA1 of 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3 | 2025-08-27 | |
| FileHash-SHA1 | c8744b10180ed59bf96cf79d7559249e9dcf0f90 | — | 2025-08-27 | |
| FileHash-SHA1 | eca96bd74fb6b22848751e254b6dc9b8e2721f96 | — | 2025-08-27 | |
| FileHash-SHA256 | 3299866538aff40ca85276f87dd0cefe4eafe167bd64732d67b06af4f3349916 | — | 2025-08-27 | |
| FileHash-SHA256 | 4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3 | — | 2025-08-27 | |
| FileHash-SHA256 | 65c42a7ea18162a92ee982eded91653a5358a7129c7672715ce8ddb6027ec124 | — | 2025-08-27 | |
| FileHash-SHA256 | 6d473212d0cb7ab33a738807745b6cf151a2b5c331656774df59e1a4e2230468 | SHA256 of c8744b10180ed59bf96cf79d7559249e9dcf0f90 | 2025-08-27 | |
| FileHash-SHA256 | cc4db3d8049043fa62326d0b3341960f9a0cf9b54c2fbbdffdbd8761d99add79 | — | 2025-08-27 | |
| FileHash-SHA256 | d1626c35ff69e7e5bde5eea9f9a242713421e59197f4b6d77b914ed46976b933 | — | 2025-08-27 | |
| FileHash-SHA256 | e787f64af048b9cb8a153a0759555785c8fd3ee1e8efbca312a29f2acb1e4011 | — | 2025-08-27 | |
| SSLCertFingerprint | 6d:47:32:12:d0:cb:7a:b3:3a:73:88:07:74:5b:6c:f1:51:a2:b5:c3:31:65:67:74:df:59:e1:a4:e2:23:04:68 | — | 2025-08-27 | |
| YARA | 95a89dff5e42614e30ba6aab6623133043f6f122 | CANONSTAGER is a side-loaded DLL launcher used to decrypt and execute a payload in-memory. | 2025-08-27 | |
| YARA | 9e82021ffd943c51b1a164832ea5a6d28b16dec7 | STATICPLUGIN is a downloader observed to retrieve an MSI packaged payload from a hard-coded C2 domain. | 2025-08-27 | |
| domain | mediareleaseupdates.com | — | 2025-08-27 |