Since at least March 2022, a suspected Chinese state-sponsored threat actor has been conducting a cyberespionage campaign targeting government agencies, defense organizations, and a certificate authority (CA) in multiple Asian countries. The threat actor is known as “Billbug” (a.k.a. Thrip, Lotus Blossom, Spring Dragon), and according to security researchers they have been active for at least a decade. This information has come to light following the publication of a report by Symantec, who’ve been tracking Billbug since 2018. This is a very sophisticated threat actor, notorious for leveraging available tools and public utilities that are already present on the victim system such as WinRAR and tracert, as well as deploying custom malware. This tactic helps the threat actor to avoid detection and persist in the target environment for longer. Symantec was able to attribute this campaign to Billbug after identifying the use of two (2) proprietary backdoors that have been used in their other campaigns known as Hannotog (“Backdoor.Hannotog”) and Sagerunex (“Backdoor.Sagerunex”). The Hannotog backdoor is a one-stop-shop that forces the victim’s firewall to “enable all traffic and allows the threat actor to establish persistence on the compromised machine, upload encrypted data, run commands, and download files to the device.” Part of the Hannotog functionality is that it drops the Sagerunex backdoor, which establishes a connection with an attacker-owned command-and-control (C2) server. Especially troubling for this latest campaign is Billbug taking aim at a CA victim. If the threat actor successfully compromises a CA, they could sign their malware with valid digital certificates, making it even harder for security measures to detect. CTIX analysts will continue to monitor state-sponsored threat actors and report on their activity to our readers.