A new espionage campaign linked to Chinese state-backed hackers is underway, targeting Chinese-speaking semiconductor companies in East Asia. The tactics, techniques, and procedures (TTPs) being used in this ongoing campaign overlap considerably with previously reported activities traced back to other People’s Republic of China (PRC) backed espionage groups like Budworm (aka APT27) and RedHotel. It’s known that the group conducting the current espionage campaign has posed as Taiwan Semiconductor Manufacturing Company (TSMC) – one of the major players in the semiconductor industry – to trick victims into clicking on malicious links. While it’s still unclear how they first gained access to the targeted systems, it’s likely that phishing emails were used. The HyperBro loader is executed on the victim’s computer, disguised as an alleged TSMC PDF file that’s used to install a Cobalt Strike beacon and infect the device. Cobalt Strike is a legitimate penetration testing software tool that’s often abused by cybercriminals to remotely issue commands and steal information from victims, as is the case for how it was used in this scenario. Additionally, a second variant of the attack leveraged a compromised Cobra DocGuard web server to drop an additional McAfee binary and load more Cobalt Strike shellcode using DLL side-loading. Hackers in this case deployed a previously undocumented Go-based backdoor named “ChargeWeapon”, designed to gather and transmit host data to the attacker-controlled command-and-control (C2) server, information which likely aided the threat actor in performing initial reconnaissance efforts to identify high-value targets. The attacks observed in this campaign also utilized many obfuscation techniques that help covertly run the malware in the background and keep firewall defenses from detecting executables and processes.