Connect with us

Telecom

Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds

Published

on

Sophos logo
Kindly share this post

Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.

Sophos logo

Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.

After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.

While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.

“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.

“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.

“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.

“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”

Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.

While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.

In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.

Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.

Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.

However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.

“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.

“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.

To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).

For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.


Kindly share this post

Ugo Onwuaso is an ICT enthusiast. He believes technology should be used for general good. He holds a Master of Public Administration (MPA) degree from the Lagos state University. Dear Reader, Your support matters. But we believe that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. That is why, we have devoted our energy to independent reportage of technology and finance and how they affect lives. Our incisive and analytical view of how technology news affects the daily life help individuals and organizations make up their minds. Quality journalism costs money. Today, we're asking that you support us to do more. Kindly support our effort to deliver technology and finance journalism to everyone in the world. Donate as little as N1,000. Bank transfers can be made to: UBA Plc 1017156876 Communication Week Media Ltd

Telecom

Terra Moves to Expand in African Drone Sector, Secures $22m Funding

Published

on

Kindly share this post

Olugbenga Agboola, Flutterwave CEO has joined a $22 million funding extension for Nigerian defensetech start-up Terra Industries as Africa’s fast-growing drone and security technology sector begins to attract capital far beyond traditional venture circles.

The round was led by Lux Capital, with participation from Agboola through Resilience17 Capital and returning investors including 8VC and Nova Global.

It follows an $11.75 million raise just weeks earlier, bringing Terra’s total funding to $34 million as the company accelerates expansion into high-risk security markets.

Terra, founded in 2024 by 24-year-old chief engineer Maxwell Maduka and CEO Nathan Nwachuku, builds autonomous drones and surveillance systems designed to protect critical infrastructure such as energy facilities, logistics corridors and industrial sites. The startup says it is already safeguarding assets worth billions of dollars while securing early federal and commercial contracts.

Agboola’s involvement highlights a broader shift in African tech investment patterns. While fintech has long dominated venture flows, escalating infrastructure sabotage and terrorism threats have elevated demand for locally developed security hardware.

“Nigeria’s drone ecosystem is rapidly evolving from hobbyist and mapping use cases toward industrial monitoring, border surveillance and energy protection, areas increasingly seen as foundational to economic stability.

“This is about backing infrastructure security at scale. Africa’s growth depends on resilient systems that protect critical assets,” said Agboola.

Terra CEO Nwachuku is adamant that locally engineered systems are better suited to African operating conditions. “We are building tools designed for the realities on the ground. Security technology should not always be imported when local innovation can respond faster and more effectively,” he stated.

Lux Capital partner Brandon Reeves underlined that the investor appetite, which has drawn fintech heavyweight interest such as Agboola, reflects rising cross-sector confidence in African defense technology as a commercial category. “Security is a prerequisite for economic growth,” he said.

“As Terra ramps production and expands regionally, its funding milestone illustrates a wider transformation. Drone and autonomous security platforms are no longer peripheral experiments but emerging pillars in Africa’s technology landscape, where fintech leaders and venture capital converge around safeguarding the infrastructure powering the continent’s next growth phase,” said Reeves

 


Kindly share this post
Continue Reading

Telecom

Temu Assures Compliance Amid Nigeria Data Privacy Probe

Published

on

Kindly share this post

Temu, the global e-commerce platform expanding in Nigeria, has officially addressed an inquiry from the Nigeria Data Protection Commission (NDPC) over alleged data privacy violations, confirming its commitment to compliance with the Nigeria Data Protection Act (NDPA) 2023.

Temu Assures Compliance Amid Nigeria Data Privacy Probe

Temu

The company’s response follows NDPC’s investigation into Temu’s data processing practices.

In a statement to Nigeria CommunicationsWeek, Temu stressed its dedication to local and international data protection standards, noting ongoing communication with the regulator. “At Temu, protecting user privacy and data security is a top priority. We are committed to complying with applicable laws and regulations in our data practices,” the statement read.

Temu further affirmed: “We can confirm that Temu has received the inquiry and is engaging with the Commission. We will continue to engage in open and constructive dialogue with the NDPC to address any questions or concerns.”

Under Dr. Vincent Olatunji’s leadership, NDPC has ramped up scrutiny of foreign digital platforms to safeguard Nigerian citizens’ personal data—from contact details to financial information—ensuring transparent and secure handling. For e-commerce giants like Temu, managing vast consumer data volumes demands strict regulatory alignment to sustain operations and trust in Africa’s biggest economy.

Industry observers view Temu’s proactive stance as a savvy bid to ease tensions, mirroring Nigeria’s firm handling of platforms like X (formerly Twitter) and fintechs. This engagement underscores NDPC’s rising clout, compelling investors and foreign entrants to prioritise data compliance costs.

Nigeria CommunicationsWeek sees Temu’s approach as a model for global retailers eyeing Nigeria’s booming digital retail sector through 2026.


Kindly share this post
Continue Reading

Telecom

NIMC Rolls Out WorkflowPro for Paperless Correspondence

Published

on

Kindly share this post

National Identity Management Commission (NIMC) has deployed WorkflowPro as its official platform for the digital submission and management of correspondence.

NIMC Rolls Out WorkflowPro for Paperless Correspondence

NIMC

Kayode Adegoke Phd, Head, Cooperate Communications of NIMC said this in a press statement on Tuesday, 17th February, 2026, pointing out that this was “In furtherance of President Bola Ahmed Tinubu’s Renewed Hope Agenda and the Federal Government’s commitment to institutionalizing a paperless public service.”

According to the statement, “The   adoption   of   WorkflowPro   marks   NIMC’s   formal   transition   to   a   paperless operating   environment   and   reflects   the   Commission’s   resolve   to   strengthen governance,    improve    administrative    efficiency,    and    standardize     records management in line with approved public sector reforms. The platform  provides a  secure,  structured,  and   traceable  system   for  managing   both  internal   and external  communications,  thereby  enhancing  accountability  and  operational transparency.

“Under the new framework, all external correspondence to NIMC will be processed electronically  through  WorkflowPro.  The  system  enables  end-to-end  tracking  of submissions,  accelerates  internal   routing   and  response  timelines,  and   ensures secure  electronic  archiving of  official  records. This  approach  eliminates  the risks associated  with  manual  handling  of  documents  while  reinforcing  compliance with established information management standards.”

Adegoke added that “The implementation of  WorkflowPro is  consistent with  the  Federal  Government’s Enterprise Content Management  (ECM)  policy, which mandates the digitization of   official   records   and   the   elimination   of   physical   file   movements   across   all Ministries, Departments, and Agencies  (MDAs) .

“Accordingly,  all  external   correspondence  addressed  to  the   National   Identity Management Commission must be submitted via the NIMC WorkflowPro platform, accessible through the official portal link or by scanning the designated QR code:
Portal Link:https://workflowpro-nimc.com/Submit . Correspondence

To  support  effective  implementation,  NIMC  has  approved  a  30-day  transition period   from   the   date   of   this   announcement,   during  which  stakeholders   are expected  to acquaint themselves with  the  new  process.  Upon  the expiration of this   period,   the   Commission   will   discontinue   the   acceptance   of    manually submitted letters and paper-based correspondence.

“WorkflowPro  was   developed   by   NIMC’s   in-house   technical   team   under   the directive   of   the   Director-General/Chief   Executive   Officer,   Engr.   (Dr.)  Abisoye Coker-Odusote. The platform forms part of a broader institutional reform agenda aimed   at   strengthening    the   security   of    official   communications,    reducing administrative   delays,   and   entrenching   digital   governance  within   the   public service.

“The  National  Identity  Management  Commission  enjoins  all  stakeholders  to  take note of this policy directive and ensure full compliance.”


Kindly share this post
Continue Reading

Trending