# CL-UNK-1068: China-Nexus APT Targeting Critical Infrastructure via DLL Sideloading, Xnote Backdoor, ScanPortPlus Scanner, and FRP Tunneling

> Unit 42 identified CL-UNK-1068, a China-nexus threat cluster active since at least 2020, targeting aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors across South, Southeast, and East Asia. The group employs cross-platform capabilities including DLL sideloading via python.exe to deploy the Xnote Linux backdoor, custom ScanPortPlus Go-based scanner, and modified Fast Reverse Proxy (FRP) for persistent tunneling, alongside web shells (GodZilla, AntSword), credential theft tools, and privilege escalation exploits.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0187
- **ID:** TL-2026-0187
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** CL-UNK-1068 (China)
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2021-4034, CVE-2023-34048

## Description

CL-UNK-1068 is a previously undocumented Chinese threat activity cluster tracked by Unit 42. Attribution to a Chinese threat actor is assessed with high confidence based on tool provenance from Chinese security communities, linguistic artifacts in configuration files (e.g., FRP authentication token 'frpforzhangwei' referencing a common Chinese name), exclusive use of Xnote malware historically associated with Chinese operators since 2015, and consistent targeting patterns aligned with Chinese strategic intelligence collection priorities.

The group's primary objective is assessed with moderate-to-high confidence to be cyberespionage, although cybercriminal motivation cannot be fully ruled out. Operations have been ongoing since at least 2020, targeting critical infrastructure organizations across South Asia, Southeast Asia, and East Asia.

**Initial Access:** CL-UNK-1068 gains initial access by exploiting public-facing web applications on target servers, subsequently deploying web shells including GodZilla and AntSword variants written in English and Simplified Chinese.

**Post-Compromise Operations:** After establishing initial access, the group executes extensive reconnaissance using batch scripts (hp.bat, hpp.bat) to enumerate user accounts, network configuration, running processes, installed software, security products, connected servers via PuTTY/RDP/VNC history, IIS sites, and Windows Security logs.

**DLL Sideloading:** A key technique involves deploying legitimate Python executables (python.exe, pythonw.exe) alongside a malicious python20.dll loader and obfuscated shellcode files. When the legitimate executable runs, it loads the malicious DLL which decrypts and executes payloads in-memory, delivering ScanPortPlus, FRP, and other tools while evading detection.

**Credential Theft:** The group deploys LsaRecorder (sourced from Chinese Kanxue security forum) to hook the LsaApLogonUserEx2 callback and capture login passwords, Mimikatz for credential dumping, DumpIt with Volatility for extracting NTLM hashes from SAM and cached credentials, and a custom SSMS password export tool.

**Privilege Escalation:** Multiple techniques are employed including PrintSpoofer/PrintProgram exploiting the Windows Print Spooler service, srunas.exe for access token duplication, PwnKit (CVE-2021-4034) on Linux systems, CVE-2023-34048 exploitation against VMware vCenter servers, and Sliver implants with PPID spoofing.

**Persistence and Tunneling:** FRP is deployed with custom authentication tokens and proxy naming conventions (Windows: '10014-win-nic-32-v', Linux: '20012-linux-64-V') using password 'f*ckroot123'. Xnote provides persistent Linux backdoor access with DDoS, file operations, reverse shell, and port forwarding capabilities.

**Data Exfiltration:** Target data includes web application configurations, source code fragments, database backups, credentials from multiple sources, and user documents. Files are archived with WinRAR, Base64-encoded with certutil, and exfiltrated through web shell output. Anti-forensics includes clearing Windows Event logs via wevtutil.

---

**Revalidated on 2026-03-12**

Six days after Unit 42's initial public disclosure on March 6, 2026, CL-UNK-1068 has received widespread industry coverage and validation from major cybersecurity outlets including The Hacker News, Dark Reading, GBHackers, CyberPress, Industrial Cyber, SC Media, Ampcus Cyber, and AboutDFIR. The threat cluster's techniques and tools have been cross-referenced against the broader Chinese cyber-espionage ecosystem, revealing significant overlaps with other documented PRC-aligned operations.

FRP (Fast Reverse Proxy), CL-UNK-1068's primary persistence mechanism, is now tracked by MITRE ATT&CK as Software S1144 and is associated with four threat groups: Volt Typhoon (G1017), Blue Mockingbird (G0108), Magic Hound (G0059), and AppleJeus (G1049). CISA Advisory AA24-038A specifically documented Volt Typhoon's use of obfuscated FRP client files for C2 communications in confirmed compromises of U.S. critical infrastructure, establishing a direct TTP overlap with CL-UNK-1068's modified FRP deployment. The broader Chinese state-sponsored threat landscape was further addressed by CISA Advisory AA25-239A (August 2025), a joint advisory from 19 international agencies documenting PRC actors compromising telecommunications, government, and transportation networks worldwide — sectors that directly overlap with CL-UNK-1068's targeting.

The Xnote backdoor used by CL-UNK-1068 has been confirmed as a shared tool within the Chinese offensive community, previously linked to Earth Berberoka (GamblingPuppet) by Trend Micro for gambling-site targeting. This cross-group tool sharing is consistent with patterns documented across Chinese APT operations, including recent Mustang Panda/Stately Taurus DLL sideloading campaigns against Southeast Asian governments in 2025-2026 and the broader trend of Chinese-aligned groups sharing tooling from forums like Kanxue.

Community Sigma detection rules now cover two of CL-UNK-1068's signature techniques: FRP execution detection (Sigma rule 32410e29, severity HIGH, maps to T1090 Proxy) and Python DLL sideloading detection (Sigma rule d36f7c12, severity MEDIUM, maps to T1574.001). The 2026 Unit 42 Global Incident Response Report, analyzing over 750 major incidents across 50+ countries, confirmed that Chinese-aligned groups are increasingly targeting virtualization platforms and databases with malware designed to hide C2 within legitimate web sessions — a persistence strategy that shares conceptual overlap with CL-UNK-1068's FRP tunneling approach.

No new IOCs, no additional campaigns, and no dedicated government advisory specifically naming CL-UNK-1068 have emerged since the initial disclosure. The threat remains active with the IOCs and infrastructure documented in the original Unit 42 report. Organizations in the targeted sectors (aviation, energy, government, law enforcement, pharmaceutical, technology, telecommunications) across South, Southeast, and East Asia should treat CL-UNK-1068 as an active threat and prioritize monitoring for the specific TTPs and IOCs published by Unit 42.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505 Server Software Component
- T1547 Boot or Logon Autostart Execution
- T1574 Hijack Execution Flow
- T1068 Exploitation for Privilege Escalation
- T1134 Access Token Manipulation
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1046 Network Service Discovery
- T1087 Account Discovery
- T1518 Software Discovery
- T1570 Lateral Tool Transfer
- T1021 Remote Services
- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1572 Protocol Tunneling
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol
- T1498 Network Denial of Service

## Sources

- [Unit 42: CL-UNK-1068 Targets Critical Sectors — Years of Undetected Operations](https://unit42.paloaltonetworks.com/cl-unk-1068-targets-critical-sectors/)
- [Unit 42 Threat Actor Groups Tracked by Palo Alto Networks](https://unit42.paloaltonetworks.com/threat-actor-groups-tracked-by-palo-alto-networks-unit-42/)
- [Unit 42 IOC Repository — GitHub](https://github.com/pan-unit42/iocs)
- [Dr.Web: Linux.BackDoor.Xnote.1 Malware Description](https://vms.drweb.com/virus/?i=4372602)
- [MITRE ATT&CK: DLL Side-Loading T1574.002](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK: Network Service Discovery T1046](https://attack.mitre.org/techniques/T1046/)
- [Fast Reverse Proxy (FRP) — GitHub Source](https://github.com/fatedier/frp)
- [Sliver Adversary Emulation Framework — GitHub](https://github.com/BishopFox/sliver)
- [PwnKit CVE-2021-4034 Exploit — GitHub](https://github.com/ly4k/PwnKit)
- [PrintSpoofer Privilege Escalation Tool — GitHub](https://github.com/itm4n/PrintSpoofer)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0187