Recent reports highlight the involvement of a China-based threat actor, known as Emperor Dragonfly or Bronze Starlight, in a ransomware attack utilizing espionage tools typically linked to state-backed groups. This actor deployed RA World ransomware against an unnamed medium-sized Asian software and services company in November 2024, demanding a $2 million ransom. The attack marks a convergence of espionage and financially motivated cybercrime. Researchers identified the use of a distinct toolset, including the PlugX (Korplug) backdoor, which was previously associated with espionage activities by groups like Mustang Panda. The attack involved DLL sideloading using a legitimate Toshiba executable to load PlugX, followed by ransomware deployment. The attackers exploited a known vulnerability in Palo Alto Networks PAN-OS (CVE-2024-0012) to gain initial access, after which they stole credentials and exfiltrated data before encrypting systems. This pattern suggests that Chinese state-backed operatives may be moonlighting as ransomware actors for personal gain in tangent with their role as cyberspies. The overlap in tactics between espionage and ransomware operations raises questions about the motivations and structure of these threat actors. While unusual in the Chinese context, similar behaviors have been observed in threat actors from Iran and North Korea. Researchers theorize that a lone actor within the espionage group could be responsible, seeking financial gain using their employer’s toolkit. This aligns with observations of some state-sponsored groups conducting financially motivated operations to supplement their income. The incident underscores the complexity of cyber threat landscapes, where traditional boundaries between state-sponsored espionage and cybercrime are increasingly blurred.