Pulse Detail — Threat Intelligence

PULSE NAME

PRC-Nexus Espionage Campaign Hijacks Web Traffic to Target Diplomats | Google Cloud Blog

WHITE Nexus Espionage CyberHunter_NL 2025-08-27 Modified: 2025-09-26

IOCs

MEDIUM VOLUME

Google has identified and identified a Chinese government-backed cyber espionage campaign that targeted diplomats in Southeast Asia in March 2025 and is likely to have been carried out by a PRC-nexus threat actor.

MITRE ATT&CK & Malware Families

ATT&CK TECHNIQUES

T1566 T1113 T1546 T1140 T1105 T1071 T1574 T1036 T1553

MALWARE FAMILIES

Threat Intelligence PlugX Digitally Signed Signed UNC6384 SOGU.SEC

Indicators of Compromise (7 / 26 total)

All FileHash-MD5 FileHash-SHA1 FileHash-SHA256 SSLCertFingerprint YARA domain

TYPE	INDICATOR	DESCRIPTION	CREATED
FileHash-SHA256	3299866538aff40ca85276f87dd0cefe4eafe167bd64732d67b06af4f3349916	—	2025-08-27
FileHash-SHA256	4ed76fa68ef9e1a7705a849d47b3d9dcdf969e332bd5bcb68138579c288a16d3	—	2025-08-27
FileHash-SHA256	65c42a7ea18162a92ee982eded91653a5358a7129c7672715ce8ddb6027ec124	—	2025-08-27
FileHash-SHA256	6d473212d0cb7ab33a738807745b6cf151a2b5c331656774df59e1a4e2230468	SHA256 of c8744b10180ed59bf96cf79d7559249e9dcf0f90	2025-08-27
FileHash-SHA256	cc4db3d8049043fa62326d0b3341960f9a0cf9b54c2fbbdffdbd8761d99add79	—	2025-08-27
FileHash-SHA256	d1626c35ff69e7e5bde5eea9f9a242713421e59197f4b6d77b914ed46976b933	—	2025-08-27
FileHash-SHA256	e787f64af048b9cb8a153a0759555785c8fd3ee1e8efbca312a29f2acb1e4011	—	2025-08-27

References (1)

↗ https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats/