State-Sponsored Cyber Activity Targeting Telecoms in Southeast Asia and Global Attribution Dynamics

August 2, 2025

Telecommunications networks have become prime targets in a growing cyber-espionage arms race. In 2024, a covert campaign attributed to the threat actor CL-STA-0969 quietly compromised telecom infrastructure across Southeast Asia. Operating with advanced tradecraft and high OPSEC, the group deployed specialized tools to maintain persistent access—without immediate signs of data theft or disruption.

Links to known Chinese espionage groups like Liminal Panda and LightBasin suggest CL-STA-0969 is part of a broader ecosystem focused on strategic access to communications infrastructure. At the same time, China has publicly accused U.S. agencies of conducting parallel intrusions, highlighting the increasingly reciprocal and opaque nature of global cyber operations.