The Salt Typhoon Playbook: China’s Cyber Campaign Against Global Infrastructure
CommandEleven’s series on China’s cyber campaign against global infrastructure, from Salt Typhoon’s router implants to the August 2026 US grid emergency.
ASEAN Cyber Espionage Landscape: Cyber-Kinetic Convergence and Industrialized Intrusion Vectors – Part 8
China’s industrialized APT ecosystem in ASEAN, 2025-26: Salt Typhoon, Flax Typhoon and Mustang Panda pivot to edge devices, MSPs and telecom carriers.
ASEAN Cyber Espionage Ecosystems & Sub-Sea Interception – Part 5
Technical intelligence assessment analyzing threat actor taxonomy, custom malware implant mechanics, and sub-sea fiber network interception operations in ASEAN.
ORB Botnets & Edge Appliance Exploitation in ASEAN – Part 4
How APT40 and Mustang Panda route ASEAN espionage through ORB botnets of hijacked home routers and exploit edge appliances, and the defenses that blunt it.
ASEAN Cyber Espionage Topologies & APT TTPs Analysis – Part 2
Technical intelligence assessment analyzing advanced persistent threat TTPs, dual-vector supply-chain infiltration, and critical infrastructure compromise.
ASEAN Cyber Espionage & Critical Infrastructure Penetration – Part 1
China-aligned APTs target ASEAN foreign ministries, ports and power grids via edge devices, PlugX, ShadowPad and Salt Typhoon router implants, July 2026.
Mustang Panda CoolClient Evasion Framework Forensics – Part 3
Mustang Panda’s 2026 CoolClient backdoor against ASEAN ministries: a four-stage side-loaded loader, surveillance plugins, and YARA and EDR hunting cues.
Chinese Cyber-Attacks Against Western Critical Infrastructure – Part 7
An intelligence analysis of offensive cyber doctrines, evaluating SOHO proxy networks, operational technology pre-positioning, and supply chain interception.
Cyber Intelligence Report: Global C2 Exploitation of Telecom Networks – Part 6
1,357 C2 servers in 14 Middle Eastern states, 72% on Saudi Telecom networks: how APTs and criminals hide command traffic inside commercial telecoms.