Chinese-speaking
This APT group was seen using a watering hole attack to deploy a feature-rich implant known as LightSpy against users in Hong Kong in winter 2020. Potential victims are redirected to an exploit site via posts and replies on online messaging channels; the malicious implant contains backdoor malware. TwoSail Junk’s activity is potentially linked to the long-running APT group Spring Dragon.