A sophisticated China-linked threat actor has been conducting extensive cyber espionage operations targeting critical infrastructure and high-value organizations across multiple sectors. This activity cluster, tracked as PurpleHaze, demonstrates technical overlaps with previously identified Chinese advanced persistent threats and employs a strategic approach of compromising upstream service providers to potentially gain access to downstream targets of interest. The intrusions leverage a complex infrastructure that includes an operational relay box (ORB) network operated from China and actively used by several suspected Chinese cyber espionage actors. In parallel intrusions, the threat actors deployed ShadowPad, a modular backdoor platform used by multiple suspected China-nexus threat actors. These ORB networks represent a growing trend among threat groups, creating dynamic and evolving infrastructure that complicates detection, tracking, and attribution efforts. Between July 2024 and March 2025, this threat cluster compromised over 70 organizations spanning sectors including manufacturing, government, finance, telecommunications, and research. This demonstrates the shared tooling and potential collaboration between different China-linked threat groups targeting strategic sectors globally. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The backdoor establishes persistent communication channels through the ORB network infrastructure, enabling long-term monitoring and data exfiltration while maintaining a minimal footprint. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. SentinelOne researchers identified this threat activity during an investigation of a 2024 intrusion against an organization providing hardware logistics services for SentinelOne employees. The malware utilizes a multi-stage deployment process, initially delivered as an obfuscated payload that decrypts and loads the GoReShell backdoor directly into memory to evade on-disk detection. The attackers primarily gained their initial foothold by exploiting an n-day vulnerability in CheckPoint gateway devices, establishing persistent access before moving laterally through victim networks.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 30 Apr 2025 14:35:11 +0000