A Chinese-backed threat group has been targeting organizations throughout the manufacturing and energy sectors, as well as federal agencies in several countries. The threat group, tracked as TA423 and Red Ladon, is an espionage-motivated organization that has been active since 2013. TA423 often plans its attacks around significant political events within the Asia-Pacific region, with a concentration on Southern China. Throughout TA423’s nearly decade long activity, they have targeted entities within government agencies, universities, legal firms, defense contractors, and foreign businesses tied to South China Sea operations. TA423’s most recent campaign heavily targeted local and federal Australian government agencies, media companies, and manufacturing organizations specifically associated with the maintenance of wind turbines. Threat actors often posed as employees of the Australian Morning News in this phishing campaign in an attempt to lure users to visit actor-controlled infrastructure via malicious link. Once opened, the user is taken to a malicious website where the ScanBox framework was being hosted. With ScanBox, TA423 has the capability to configure specific plugins to execute on the infected system and exfiltrate targeted data back to command-and-control (C2) servers. CTIX continues to urge users to validate the integrity of all email correspondence prior to clicking any links or downloading any files to lessen the risk of threat actor compromise.