Telecom
Operation Crimson Palace: Chinese State-Sponsored Espionage, Expands in Southeast Asia – Sophos Report Finds
Sophos, a global leader of innovative security solutions for defeating cyberattacks, on Tuesday released its report, “Crimson Palace: New Tools, Tactics, Targets,” which details the latest developments in a nearly two-year long Chinese cyberespionage campaign in Southeast Asia.
Sophos X-Ops first reported on what they named Operation Crimson Palace in June and detailed Sophos X-Ops’ discovery of three separate clusters of Chinese nation-state activity—Cluster Alpha, Cluster Bravo and Cluster Charlie—inside a high-profile government organization.
After a brief hiatus in August 2023, Sophos X-Ops noted renewed Cluster Bravo and Cluster Charlie activity, both within the initial targeted organization and in numerous other organizations within the region.
While investigating this renewed activity, Sophos X-Ops uncovered a novel keylogger that the threat hunters named “Tattletale,” which can impersonate users who have signed into the system and gather information related to password policies, security settings, cached passwords, browser information, and storage data. Sophos X-Ops also notes in the report that, in contrast to the first wave of the operation, Cluster Charlie increasingly switched to using open-source tools rather than deploying the types of custom malware they developed in the initial wave of activity.
“We’ve been in an ongoing chess match with these adversaries. During the initial phases of the operation, Cluster Charlie was deploying various bespoke tools and malware,” said Paul Jaramillo, director, threat hunting and threat intelligence, Sophos.
“However, we were able to ‘burn’ much of their previous infrastructure, blocking their Command and Control (C2) tools and forcing them to pivot.
“This is good; however, their switch to open-source tools demonstrates just how quickly these attacker groups can adapt and remain persistent. It also appears to be an emerging trend among Chinese nation-state groups.
“As the security community works to secure our most sensitive systems from these attackers, it’s important to share the insights into this pivot.”
Cluster Charlie, which shares tactics, techniques and procedures (TTPs) with the Chinese threat group Earth Longzhi, was originally active from March to August 2023 in a high-level government organization in Southeast Asia.
While the cluster was dormant for several weeks, it re-emerged in September 2023 and was active again until at least May 2024. During this second stage of the campaign, Cluster Charlie focused on penetrating deeper into the network, evading endpoint detection and response (EDR) tools and gathering further intelligence.
In addition to switching to open-source tools, Cluster Charlie also began using tactics initially deployed by Cluster Alpha and Cluster Bravo, suggesting that the same overarching organization is directing all three activity clusters.
Sophos X-Ops has tracked ongoing Cluster Charlie activity across multiple other organizations in Southeast Asia.
Cluster Bravo, which shares TTPs with the Chinese threat group Unfading Sea Haze, was originally only active in the targeted network for a three-week span in March 2023.
However, the cluster reappeared in January 2024, only this time it was targeting at least 11 other organizations and agencies in the same region.
“Not only are we seeing all three of the ‘Crimson Palace’ clusters refine and coordinate their tactics, but they’re also expanding their operations, attempting to infiltrate other targets in Southeast Asia.
“Given how frequently Chinese nation-state groups share infrastructure and tools, and the fact that Cluster Bravo and Cluster Charlie are moving beyond the original target, we will likely continue to see this campaign evolve—and in potentially new locations. We will be monitoring it closely,” said Jaramillo.
To learn more, read “Crimson Palace: New Tools, Tactics, Targets” on Sophos.com. For details about Sophos’ threat hunting and other services for disrupting cyberattacks, go to Sophos Managed Detection and Response (MDR).
For an in-depth look at the threat hunting behind this nearly two-year long cyber espionage campaign, register for the upcoming webinar “Intrigue of the Hunt: Operation Crimson Palace: Unveiling a Multi-Headed State-Sponsored Campaign” on Sept. 24 at 2 PM ET: https://events.sophos.com/operation-crimson-palace/.
Starting February 2027, Nigerian Communications Commission (NCC), has mandated mobile network operators and other communications service providers to notify it within four hours of detecting any cyberattack.
This is aimed at strengthening the protection of telecom infrastructure and subscriber data.
The directive is contained in the Cyber Resilience Framework for the Nigerian Communications Sector (CRF-NCS) released by the NCC last month.
According to the NCC, the rule will take effect in February 2027, giving operators a year to put in place the necessary monitoring and reporting systems.
Under the framework, telecommunications companies must alert the regulator within four hours of detecting a cyber incident and continue to provide updates every four hours until the situation is contained.
Operators are also required to submit a confirmation report within 24 hours through a dedicated reporting portal.
The commission said the framework is designed to strengthen cybersecurity oversight in a sector that handles vast volumes of sensitive consumer and national infrastructure data.
Cyber threats targeting telecom networks can lead to service disruptions, data breaches affecting subscriber information, malware infections and other attacks capable of crippling communications systems, according to the regulator.
By introducing faster reporting timelines, the commission said it hopes to improve sector-wide situational awareness and ensure quicker response to threats before they escalate into major outages or data compromises.
The framework also requires telecommunications companies to establish dedicated Security Operations Centres (SOC) to monitor networks continuously for suspicious activity and cyber threats.
These centres are expected to detect and report malicious activities promptly while coordinating responses internally.
In addition, each operator must designate a cybersecurity lead responsible for working with the commission’s Computer Security Incident Response Team (CSIRT) to share intelligence and coordinate responses to incidents affecting the communications ecosystem.
The NCC said the new framework forms part of broader efforts to strengthen resilience across Nigeria’s communications infrastructure and promote a unified cybersecurity posture in the sector.
The measures come amid growing global and domestic concern over data breaches and cyber intrusions targeting companies that manage large volumes of digital information.
Telecommunications companies, which serve as gateways for internet traffic, mobile banking, messaging and other digital services, are increasingly seen as critical infrastructure vulnerable to cyber threats.
Nigeria’s telecom regulator has in recent years tightened rules around data protection and network security as the country’s digital economy expands.
A United States federal court in the Southern District of New York has comprehensively dismissed all claims against Binance, the world’s largest cryptocurrency exchange by registered users, in a high-profile lawsuit under the Anti-Terrorism Act (ATA).
Binance
The 62-page decision represents a decisive legal victory, rejecting allegations from 535 plaintiffs who claimed the platform provided material support linked to 64 terrorist attacks.
The court meticulously examined and dismissed every central allegation, ruling that plaintiffs failed to establish Binance assisted terrorists, associated itself with the attacks, participated in or sought to advance them, or engaged in any conspiracy with terrorist organisations.
This full dismissal underscores the absence of evidence supporting the claims, affirming Binance’s long-standing position that the suit was meritless.
Binance General Counsel Eleanor Hughes described the outcome as “a complete vindication of all false allegations.” She emphasised: “The court has unambiguously rejected the false and damaging narrative that Binance assisted terrorists.
“We have always maintained these claims were without merit, and today’s ruling confirms that. We will continue to defend ourselves aggressively against any litigation or reporting that misrepresents who we are and how we operate.”
While the ruling grants plaintiffs 60 days to file an amended complaint in light of a recent appellate decision, Binance expressed strong confidence that no revisions can remedy the “fundamental deficiencies” identified by the court. The exchange views this as a thorough examination and rejection of the underlying assertions.
Binance reaffirmed its commitment to industry-leading compliance infrastructure, proactive regulatory engagement, and robust legal governance worldwide.
The company stressed that its operations do not support, facilitate, or enable terrorism in any form, and it plans to maintain constructive dialogue with regulators while pursuing vigorous defences against misleading narratives.
This development bolsters Binance’s position amid ongoing global scrutiny of crypto platforms, highlighting its operational integrity in a sector often targeted by unsubstantiated claims.
TikTok has announced an additional $200,000 investment in AI media literacy initiatives across Sub-Saharan Africa during its third annual Safer Internet Summit in Nairobi, underscoring the platform’s push for safer online spaces amid rising digital challenges.
TikTok
The two-day event, themed #SaferTogether: ‘Innovation and Safety’, gathered government officials, regulators, safety partners, and industry leaders from the region. It builds on prior summits in Ghana (2024) and Cape Town (2025), focusing on collaborative solutions for online protection.
TikTok’s Head of Government Relations and Public Policy for Sub-Saharan Africa, Tokunbo Ibrahim, stated: “Our mission is clear: to share learnings, tackle challenges, and advance actionable solutions that protect citizens online. By uniting policymakers, innovators, and creators, we ensure all-inclusive conversations for a resilient digital landscape.”
Kenya’s Cabinet Secretary for ICT, Hon. William Kabogo, who opened the summit, added: “This reflects our commitment to collaboration, sector growth, and a safe digital space. We must advance digital innovation, responsible AI governance, and strong regional partnerships.”
Boosting AI Literacy with Local Partners
A summit highlight was TikTok’s expanded $2 million AI Literacy Fund, launched globally in November 2025. The new $200,000 in ad credits targets local organisations to combat misinformation and empower users.
In Sub-Saharan Africa, initial grantees include:
Mtoto News (Kenya): Producing content to help youth engage responsibly with AI.
Africa Check (Nigeria, South Africa, Kenya): Enhancing fact-checking against AI-generated deepfakes.
CJID/DUBAWA (West Africa): Amplifying truth via independent fact-checking to fight information disorder.
Valiant Richey, TikTok’s Global Head of Partnerships, Elections & Market Integrity, said: “We partner with trusted locals because their expertise makes AI literacy impactful, empowering communities as viewers or creators.”
Transparency and Moderation Advances
Delegates explored TikTok’s AI-driven safety measures, including mandatory labelling of AI-generated content (AIGC), advanced detection, and partnerships like the Coalition for Content Provenance and Authenticity (C2PA) for watermarking.
With over 100 million daily uploads, AI aids proactive moderation: Q3 2025 data shows 14 million videos removed in Sub-Saharan Africa, 96.7% via automated tech, complementing human oversight.
The summit ended with pledges for ongoing digital safety efforts across the region.
Meta to Charge Location Fees on Ads to Six Countries from July 1, 2026
Tizeti Tests Ad-Funded Internet Access Model in Nigeria and Ghana
Court Orders Final Forfeiture of N81.1m Sterling Bank Fraud Funds
NCC Orders Telcos to Report Cyberattacks Within 4 Hours from 2027
FG Mulls Age Restriction for Kids on Social Media
Dr. Cairo Ojougboh Foundation Bolsters Nigeria’s Education Drive with ₦2.7m Student Support
Kaspersky Brings more Transparency to Threat Detection with New Hunt Hub
Kaspersky Discovers New Phishing Campaign Exploiting Google Tasks Notifications to Steal Corporate Credentials
esentry 2025 Report Shows Healthcare, Financial Services and Telecoms as Staging Grounds for Increased Cyberattacks in Africa
AfDB, UNDP Launch $10Bn AI Initiative for Africa
Telecom3 days agoDimension Data Nigeria Seals N20bn Bond Deal to Bridge Digital Infrastructure Gap
Telecom3 days agoFirst Batch of Nigerian Undergraduates Emerged in Airtel Africa Foundation Scholarships Programme
General News2 days agoZedvance Hits ₦96bn Lending Milestone, Eyes ₦250bn Target in 2026
E-Business3 days agoCBN Affirms Alpha Morgan Bank’s Capitalisation
Broadcasting2 days agoMadonna University Taps Tech Guru Adote for Strategic Board Role
E-Financial3 days agoPolaris Bank Marks IWD2026 with Renewed Pledge to Women’s Empowerment
General News3 days agoMojisola Sayo-Kazeem Reflects on Leadership, Opportunity, Women in Tech @ IWD
News3 days agoEFCC Seals Anti-Corruption Alliance with Anambra Security Chiefs, Traditional Rulers