Details Emerge on Chinese Hacking Operation Impersonating US Lawmaker

SecurityWeek reports that a Chinese state-backed operation, TA415 (also known as APT41, Barium, Brass Typhoon, Bronze Atlas, Wicked Panda and Winnti), conducted a phishing campaign in July and August 2025 aimed at US government, think tank and academic bodies involved in US-China relations and economic policy.

According to Proofpoint, the attackers sought persistent access by establishing a Visual Studio Code remote tunnel rather than deploying traditional malware, with emails spoofing the US-China Business Council and later impersonating John Moolenaar, the chair of the Select Committee on Strategic Competition between the US and the Chinese Communist Party.

The phishing messages directed recipients to password-protected archives containing a shortcut file and a hidden subfolder, from which a batch script and decoy PDF were launched to trigger a multi-stage infection that fetches the VSCode CLI from Microsoft, creates a persistence mechanism via a scheduled task, and authenticates a VS Code remote tunnel via GitHub. The campaign also collects system information and user directory contents before exfiltration.

TA415 operates out of Chengdu, China, linked to private contractors, and the timing underscores ongoing shifts in economic and foreign policy dynamics between China and the United States, according to Proofpoint.