Chinese threat actors conducted a cyberespionage campaign targeting Iranian government entities in the second half of 2022. Tracked as BackdoorDiplomacy, these threat actors have been active since 2017 and often target foreign affairs and telecommunications companies throughout Europe, Asia, Middle East, and Africa. In previous operations, these actors utilized several proxy/tunneling tools, a variant of the “Quarian” backdoor, and lateral movement techniques to further their espionage capabilities. This recent cyberespionage campaign was in operation between July 2022 through December 2022 and compromised several Iranian government networks, including the network tied to the Ministry of Foreign Affairs and the Natural Resources Organization. BackdoorDiplomacy actors utilized variants of the “Turian” backdoor which included upgraded obfuscation tactics, decryption algorithms, and the ability to execute remote commands and spin up reverse shells. As this cyberespionage campaign aged on, the threat actors continued to update their Turian backdoor variant to adapt to new environments and establish stealthy command-and-control (C2) communications. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.