China linked Silk Typhoon targeted diplomats by hijacking web traffic

According to Google’s Threat Intelligence Group (GTIG), the China-linked Silk Typhoon APT targeted diplomats by hijacking web traffic and redirecting them to a malware-delivery site via captive portal redirects. In March 2025, GTIG identified a sophisticated campaign by UNC6384, linked to TEMP[.]Hex (Mustang Panda), targeting diplomats in Southeast Asia and globally.

The attackers used an adversary-in-the-middle technique and spoofed an Adobe Plugin update to deliver a signed downloader called STATICPLUGIN, which then installed CANONSTAGER and ultimately the SOGU[.]SEC backdoor, running entirely in memory. CANONSTAGER employed evasion techniques such as API hashing, TLS storage of function addresses, and indirect code execution through Windows message queues to avoid detection while maintaining C2 communication.

The operation also involved legitimate browser redirects via gstatic[.]com as part of the AitM chain, with the initial compromise method not yet disclosed. GTIG notes the campaign demonstrates PRC-nexus threat actors’ continued evolution towards stealthy tactics, including valid code signing and layered social engineering.