A previously unknown threat actor called Unfading Sea Haze has been linked to the targeting of at least eight (8) unidentified government and military entities belonging to South China Sea countries. The threat group has been active since at least 2018 and has gone undetected until now. Researchers believe Unfading Sea Haze is aligned with Chinese interests based on their choice of targets who have overlapping geo-political interests in the South Pacific, with the primary goal of the attacks appearing to be espionage. Despite no overlap in the threat actor’s attack signatures with other known hacking groups, additional elements indicate a connection to China such as the use of various Gh0st RAT variants, a commodity trojan heavily used by Chinese-speaking threat actors and in espionage campaigns by Beijing-backed government hackers. The attackers have been observed regaining repeated access to compromised systems along with conducting data exfiltration activities. Initial access has been less clear, but one known vector has been spear-phishing emails, observed as recently as May 2023, containing malicious LNK files that install a backdoor onto the victim system. Additional malware payloads and tools are used once inside the system to conduct secondary activities like expanding access, taking over administrator accounts, evading detection, and collecting browser data. Data exfiltration looks to be performed manually to capture specific information of interest, including data from messaging applications, for targeted espionage focused on sensitive information. The arsenal used by Unfading Sea Haze, as mix of custom and off-the-shelf tools, highlights the group’s flexibility and evasion techniques with a focus on bypassing traditional security measures to successfully conduct espionage missions. CTIX will continue to report on new and emerging threat groups.