← Actors

CL-STA-0048

Intel Library

CL-STA-0048

Threat actorCN0 reports from 0 vendors

CL-STA-0048 is a Chinese state-backed APT that targets strategic sectors in South Asia, particularly government and telecommunications entities, with a focus on espionage. The group has been linked to SAP NetWeaver intrusions and employs techniques such as DNS beaconing using ping commands and exploiting unpatched vulnerabilities in services like IIS, Apache Tomcat, and MSSQL. Analysts have observed its use of reverse shell commands and command-and-control traffic directed to specific IP addresses. The actor adapts its methods to evade detection and maintain persistent access to high-value networks.

Vendor aliases (1)

The same group is tracked under different names by different vendors.

VendorName
OSINTCL STA 0048

MITRE ATT&CK techniques (0)

No techniques mapped yet.

Indicators of compromise

No IOCs extracted yet from reports naming this actor.

Report timeline

Every report in the Global Intel Library that names CL-STA-0048, newest first. Open any report to see the full analysis with provenance.

    No reports in the Lore library name this actor yet.

    Threat feed IOCs (0)

    Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to CL-STA-0048. Each row shows why it was linked and where it came from.

    No feed indicators linked to this actor yet. Feeds are checked every hour.

    Public research & publications (2)

    Open-source reports about this actor collected from MISP Galaxy.