A Chinese-based cyber-espionage threat actor has compromised the internal infrastructure network of ten government ministries and agencies in Indonesia. The intrusion has been tied to the widely known Mustang Panda threat group, who primarily targets entities in the Southeast Asia region with extensive cyber-espionage campaigns. Researchers initially discovered this campaign earlier this year in April when a malicious program, dubbed “PlugX”, was detected making connections to Indonesian government agencies from a command-and-control (C2) server operated by Mustang Panda. At this time, the point-of-compromise and delivery method of the malicious program(s) is unknown. Indonesian authorities were previously notified about the intrusions in June, however weeks later the C2 server was still making connections to Indonesian government networks. Once news broke of this espionage campaign, China and Indonesia appeared to be re-establishing relations, hoping to facilitate increased trading and foreign policy initiatives to invest in neighboring countries. CTAPT will continue to monitor the ongoing situation and provide updates if deemed necessary.