Chinese state-backed threat actors have conducted several infiltrations against Roshan, a mobile phone operator that conducts business throughout Afghanistan, to steal vital data from one of the companies mail servers. Roshan supplies mobile device technology throughout the 34 provinces of Afghanistan, enabling communications for 6.5 million subscribers. These nation-state actors compromised the integrity of a corporate mail server, which was discovered to be communicating with malicious entities via command-and-control (C2) servers and passing gigabytes of data to the threat actors. This is not the first time that this specific mail server has been seen communicating with malicious entities. The earliest activity was linked to the Chinese state-backed threat group ‘Calypso’ back in July 2020 and ongoing through September 2021. In addition, earlier this year additional communications were seen on the same mail server communicating with ‘RedFoxtrot’, a Chinese advanced persistent threat (APT) group. Of the several intrusions by the Chinese threat groups, roughly 4GB of data was exfiltrated from the network as well as the potential of lateral movement within the network, which could lead to additional exfiltration. At this time the initial point-of-compromise is unknown, however CTAPT will provide an update on the situation if any further information develops.