Crimson

Crimson is a malware used in various cyber-espionage campaigns, most notably in Operation Crimson Palace. This operation has been active since March 2023, with heightened activity observed in 2024. It is a concerted effort by three Chinese Advanced Persistent Threat (APT) groups targeting Southeast Asian governmental and public service organizations. The malware was distributed through multiple channels, including a domain known as “sahirlodhi[.]com”, which was also utilized by ProjectM for the download of the Crimson tool. A blog with an Indian theme resembling the India News Tribe (intribune[.]blogspot[.]com) blog was also used by ProjectM in Operation Transparent Tribe to deliver Crimson payloads. The operational strategy of Crimson Palace is likened to a heist movie, where each participating group has a unique specialty. They establish command-and-control (C2) communications channels, often using one victim as a relay point to attack another. Despite being actively pursued by cybersecurity analysts, the three arms of Crimson Palace have managed to breach several public and private organizations in Asia, stealing sensitive strategic data and materials. The targets include more than a dozen entities in Southeast Asia, among them prominent government agencies. Researchers at Sophos Managed Detection and Response uncovered this complex, multi-cluster Chinese state-sponsored cyberespionage operation, attributing the hacking activity with high confidence to clusters associated with Chinese state-sponsored activities. The discovery emphasizes the unpredictability of such threat actors. As demonstrated by Crimson Palace, even if one group excels at a certain technique, it does not preclude the use of completely different techniques later on, making the prediction of their next moves challenging.