Cyber-espionage no longer looks like a smash-and-grab. The most capable threat actors today hide malware inside software that looks trusted, keep quiet access to networks for months or years, and route their command-and-control traffic through services and protocols that blend in with ordinary business activity. The goal is not a quick payout. It is sustained intelligence gathering and strategic advantage.

These campaigns affect far more than governments. Law firms, technology providers, telecommunications companies, manufacturers and the suppliers that serve them are all targets, because they hold information or access that a state-backed actor wants. And the line between espionage and cybercrime is blurring, as the same techniques and even the same tools appear in both. Detecting this kind of activity requires a different mindset from blocking obvious malware.

A case study: disguised as an Adobe update

On August 25, 2025, Google’s Threat Intelligence Group described a campaign by a China-nexus group it tracks as UNC6384, which overlaps with the actor widely known as Mustang Panda. The campaign targeted diplomats in Southeast Asia and other organizations worldwide.

The technique shows how espionage hides in plain sight. When a victim’s device connected to a network with a captive portal, the kind of login page used for guest Wi-Fi, the attackers hijacked that traffic and redirected the browser to a page prompting a fake Adobe plugin update. The page used a valid HTTPS certificate. The downloaded file was digitally signed with a legitimate code-signing certificate issued to a Chinese company. Once run, it loaded a backdoor, a variant of the long-used PlugX malware, directly into memory by side-loading it through a legitimate-looking software component.

Every step was designed to look normal: a familiar software brand, a padlock in the browser, a signed executable and malicious code that never touched the disk in an obvious form.

Three tactics that define modern espionage

• Malware inside trusted software. Attackers trojanize legitimate installers, compromise software update mechanisms, or abuse stolen and fraudulently obtained code-signing certificates. The 2020 SolarWinds compromise remains the best-known example of a trusted update being used to reach thousands of organizations.
• Persistent, low-noise access. Rather than deploying loud malware, many state actors “live off the land,” using built-in administrative tools and valid credentials. In its February 2024 advisory on the China-linked group Volt Typhoon, CISA said the actors had maintained access to some US critical infrastructure environments for at least five years.
• Stealthy command-and-control. Instead of connecting to obviously malicious servers, implants communicate through compromised routers, cloud services, legitimate web platforms and encrypted protocols. Networks of hijacked home and small-office routers are commonly used to make traffic appear to originate from ordinary residential addresses.

Why traditional defenses miss it

Signature-based antivirus looks for known bad files. Espionage tooling is often custom, signed, loaded in memory or not malware at all, just legitimate tools used for illegitimate purposes. Perimeter firewalls allow encrypted web traffic to popular services by necessity. And many organizations keep logs for too short a period to investigate an intrusion that began a year earlier.

The result is long dwell times. Attackers who are careful about blending in can remain inside an environment for months before anyone notices, often discovered only when a government agency or a third party notifies the victim.

Defenses that work against stealth

Catching quiet, patient attackers depends less on any single product and more on visibility and discipline. These measures, roughly in order of value, make hiding in plain sight much harder:

1. Behavioral detection on endpoints. Endpoint detection and response tools that watch for suspicious behavior, such as DLL side-loading, unusual parent-child processes or in-memory code injection, catch techniques that signatures miss.
2. Zero Trust access. Require strong authentication for every access request, limit each account to what it needs, and segment networks so that one compromised device cannot reach everything. This limits how far persistence can spread.
3. Control software installation. Restrict who can install software, allow only approved applications on sensitive systems, and never install updates prompted by a web page or network login screen.
4. Watch identity activity. Monitor for logins at unusual times, from new locations or to systems a user does not normally access. Valid-credential abuse is the hallmark of long-term access.
5. Analyze outbound traffic. Look for regular “beaconing” patterns, connections to newly registered domains and unusual data volumes to cloud services.
6. Keep logs longer. Retain security logs for at least a year where feasible so you can reconstruct a slow intrusion.
7. Use threat intelligence and hunt. Subscribe to government and vendor advisories, check your environment for published indicators and techniques, and schedule proactive threat hunts rather than waiting for alerts.
8. Protect traveling staff. Provide an always-on VPN and caution employees about public and hotel Wi-Fi, which is exactly the scenario the UNC6384 campaign exploited.

The trade-off is cost and complexity. Longer log retention, behavioral monitoring and threat hunting require investment and skilled people. For many mid-sized organizations, a managed detection and response partner is the practical way to get that capability. Our cybersecurity and compliance services help organizations build it, and our article on Chinese nation-state espionage campaigns covers the sectors most at risk.

Update (September 2026): The pattern described here continued. In late August 2025 US and allied agencies published a joint advisory on Salt Typhoon’s long-running compromise of telecommunications networks worldwide, and in September 2025 Google reported that a China-nexus backdoor called BRICKSTORM had gone undetected in victim networks for an average of 393 days, often on appliances that do not support endpoint security tools.

Frequently asked questions

Why would state-backed hackers target a mid-sized business?

Because of what the business holds or connects to: client data at a law firm, designs at a manufacturer, or network access at a technology provider that serves larger targets. Smaller organizations are often used as a stepping stone to their customers.

What is command-and-control traffic?

It is the communication channel between malware inside a network and the attacker’s infrastructure, used to send instructions and receive stolen data. Sophisticated actors disguise it as ordinary web traffic to legitimate-looking services.

How can we tell if an attacker has long-term access to our network?

Often you cannot without deliberate effort. A threat hunt reviews endpoint, identity and network logs for known techniques and anomalies. If you lack the tools or retention to do this, a compromise assessment by an outside team is a sensible starting point.

Find what is hiding in your network

Delana Technologies helps organizations detect and evict stealthy intruders through behavioral monitoring, Zero Trust design, threat hunting and compromise assessments. To assess your exposure, call 239.414.5126 or contact us.

---

Sources: Google Threat Intelligence Group, report on UNC6384 captive portal hijacking and PlugX (August 25, 2025), as reported by The Hacker News; CISA advisory AA24-038A on Volt Typhoon (February 2024); joint advisory on Salt Typhoon (August 2025); Google Threat Intelligence Group and Mandiant, BRICKSTORM report (September 2025).