Chinese threat actors have successfully executed a sophisticated and devastating cyber espionage attack against multiple government entities and defense industries within Afghanistan, Belarus, Russia, and Ukraine. In early January 2022, TA428 launched the attack in Eastern Europe and Asia against industrial plants, research and development institutes, and several government agencies and departments in the attacked countries. TA428 used a series of spear phishing emails to deploy malware using the exploit CVE-2017-11882 to deploy PortDoor malware. This same method was used in 2021 to infiltrate Russian submarine defense contractors. Additional malware was later installed, including a new malware dubbed “CotSam.” In order to ensure the delivery of CotSam, TA428 included a vulnerable version of Microsoft Word with the payload to ensure the exploit would function as intended. Using the multiple backdoors installed, TA428 proceeded with lateral movement, compromising large swaths of the infected networks. It appears that a large amount of lateral movement and password harvesting was accomplished, allowing the threat actor to gain domain privileges and extract confidential files from the networks. The stolen data was then forwarded to a second stage command-and-control (C2) server with a Chinese IP address, adding evidence to the Chinese attribution of the attack. Also given the consistent use of the same malware and methodology, much of the evidence points to this being a continuation of Chinese espionage attacks that began in 2019. CTIX analysts will continue to report on the behavior of state-sponsored threat actors, and if further fallout stems from this TA428 campaign, a future update may be published.