The telecommunication industry throughout Central Asia has seen a significant rise in threat activity with indicators linking to an emerging Chinese threat organization, now being tracked as Moshen Dragon. Moshen Dragon is employing some tactics, techniques, and procedures (TTPs) also used by two (2) additional threat groups: RedFoxtrot and Nomad Panda. While there are similarities, researchers believe there are enough distinctions to merit tracking Moshen Dragon as a separate entity. Primarily focused on cyberespionage, Moshen Dragon utilizes a variety of actor-created payloads to attack their targets. However, in these operations when a payload gets locked by the system, Moshen Dragon relies heavily on verified software applications to inject “ShadowPad” and “PlugX” malware variants onto the target system. This is possible due to an old security vulnerability within the Windows operating system that allows for DLL search order hijacking, allowing threat actors to deploy malicious payloads once the exploit is completed. CTIX analysts will continue to monitor the movements of this new threat group along with threat organizations worldwide and provide additional updates accordingly.