Telecom
Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds
Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.
Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.
After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.
While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.
“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.
“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.
“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.
“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”
Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.
While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.
In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.
Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.
Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.
However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.
“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.
“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.
To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).
For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.
Nigerian Exchange Group (NGX) hosted its annual Made of Africa (MOA) 2025 Awards on Monday, February 4, 2026. The event, held during the NGX year-end celebrations, brought together regulators, listed companies, and market operators such as MTN, BUA, Dangote, Transcorp, to celebrate achievements in compliance, sustainability, and market performance.
In his opening remarks, Dr. Umaru Kwairanga, the Chairman of Nigerian Exchange Limited, said “Excellence in compliance, sustainability, and several other categories recognises the fact that capital market operators and quoted companies must be standards not only in terms of the size of their operations but also adherence to regulations and best practices of corporate social responsibilities.”
He emphasised that the awards serve as a benchmark for excellence. He noted that the 2025 honourees demonstrated significant improvements in branding, customer service, and operational standards despite a challenging economic environment in Nigeria.
Among the evening’s significant winners was MTN Nigeria, which was honoured for its commitment to corporate transparency. The technology giant received the award for Leadership in Sustainability Reporting, emerging as the winner in a category that included Seplat Energy, BUA Cement, and Transnational Corporation of Nigeria PLC.
The award recognised the brand’s adherence to both national and global reporting standards, reflecting its role in advancing environmental, social, and governance (ESG) practices within the Nigerian corporate space.
Tobe Okigbo, Chief Corporate Services & Sustainability Officer, MTN Nigeria, said “This recognition for Leadership in Sustainability Reporting underscores our commitment to transparency and aligning with global best practices.
“As the capital market moves toward greater accountability, MTN Nigeria remains dedicated to demonstrating resilience and faith in the Nigerian economy through comprehensive and standard-compliant reporting.”
The ceremony saw several other major players in the financial sector secure multiple accolades. Chapel Hill Denham emerged as one of the night’s most successful firms, winning in categories including Fund Manager with the Largest Listed Fund Size and Market Operator with the Highest Value of Foreign Portfolio Investment (FPI) Transactions.
Other notable winners included: Cardinal Stone Securities Limited, named Broker of the Year and Equity Trader of the Year, Dangote Cement was awarded Best Issuer in terms of Fixed Income Listings, BUA Cement PLC was recognised as the Most Compliant Listed Company, and Transnational Corporation of Nigeria (Transcorp) PLC received special recognition for Capital Market Excellence in Equity.
Mr. Jude Chiemeka, the Chief Executive Officer of Nigerian Exchange Limited, congratulated the recipients, noting that the market saw a 51% close in the All-Share Index last year, making it the second-best performing market globally. He urged winners and nominees alike to continue striving for excellence to further the aspiration of a $1 trillion Nigerian economy.
Nigeria’s broadband landscape remains anchored by 4G LTE at 52.95% market share in December 2025, with 2G holding steady at 37.37%, while 5G penetration crawls at just 3.77%, per Nigerian Communications Commission (NCC) data.
4G’s dominance stems from urban smartphone migrations and MTN-Airtel infrastructure expansions, fuelling the digital economy, as 2G persists in rural areas due to feature phone reliance and a stubborn device gap.
5G growth stalls from high smartphone costs amid inflation, telco preference for 4G’s quicker returns over capital-heavy 5G rollouts, and limited mainstream apps beyond elite urban streaming in Lagos and Abuja.
Broadband subscriptions topped 112 million, lifting penetration to 51.97%—up from 42.2% in October 2024—crossing the halfway mark for the first time, though monthly gains of 2-3 million slowed mid-year amid population growth and regional disparities.
The NCC’s 70% target stays elusive, highlighting sustained urban-rural demand but underscoring needs for affordable devices, infrastructure, and use cases to accelerate high-speed access nationwide.
Nigeria’s internet subscriber base surged to 148.2 million by December 2025, achieving 68.3% penetration, even amid 50% tariff hikes and naira depreciation, according to Nigerian Communications Commission (NCC) data.
MTN and Airtel dominated with 86% market share, Airtel adding 1 million subscribers in December alone, while Glo and 9mobile lagged as legacy players.
Data consumption exploded 35% to 13.25 million terabytes yearly, but Nigerians spent ₦20.87 billion daily—totalling ₦7.62 trillion ($5.58 billion)—as gigabyte prices doubled from ₦287 to ₦575.
User frustrations mounted from network failures, thousands of fibre cuts due to construction and vandalism between January and August 2025, and poor service quality despite billions in revenue. 4G LTE held 52.95% share as the workhorse, 2G clung to 37.37% in rural areas, and 5G remained a 3.77% urban luxury limited by device costs and base stations.
The NCC’s 70% broadband target fell short at 51.97%, though the ICT sector boosted Q3 GDP by ₦7.47 trillion and restored telco profits post-2024 losses.
In 2026, attention shifts to quality matching rising costs, with users urged to stay powered amid persistent “spinning wheel” woes.
LG Nigeria Begins Nationwide Search for Oldest Working TV, Rewards Loyalty with AI QNED Upgrade
AfCFTA, AGRA Collaborate to Reduce Non-tariff Barriers to Intra-African Food Trade
African Leaders Highlight Africa’s AI Ambitions
MTN, BUA, Dangote & Other Industry Giants Triumph at NGX Made of Africa Awards
4G Dominates Nigeria’s Broadband as 5G Lags Behind
Firm Detected a Fivefold Surge in QR Code Phishing Attacks in the Second Half of 2025
Nigeria’s 9 Top FinTech Firms Valued at $10.6Bn in January 2026
DG NCC Tasks University Dons on Research Commercialization, IP Management to Build Global Competitive Ecosystems
Firm Detected a Scam Exploiting OpenAI’s Teamwork Features
Kaspersky Launches OT Calculator to Align Cybersecurity Investments with Business Goals
General News2 days agoNigeria’s Banks Race to Meet CBN Recapitalisation Deadline Amid Verification Push
General News2 days agoJumia Targets Break-even in 2026 After Strong Q4 Surge
General News2 days agoBOI, MTN Foundation Unveil N1Bn Fund for Women Entrepreneurs
General News1 day agoUBA Unveils Diaspora Platform to Connect Global Africans with Investment, Wealth Opportunities
E-Financial2 days agoNo VAT on Land, Buildings and Rent Under New Tax Law — Oyedele
E-Financial2 days agoCBN Slams Up to N10m Fine on Banks and Cheque Printers for Security Breaches
E-Financial2 days agoIs Nigeria Borrowing to Survive or to Build?
General News23 hours agoLeo Stan Ekeh Foundation, Zinox Group To Invest 10B on 1000 University Tech Scholarships for Indigent Nigeria Wiz-kids