Chinese-speaking
This cyberespionage group has been active since at least 2012 and is known for campaigns against military, diplomatic, and infrastructure targets in Asia and Eastern Europe. They typically distribute their custom backdoor (Bisonal) via spear-phishing emails containing malicious attachments. Their success primarily comes from their effective application of social engineering tactics, rather than their malware’s sophistication.