A Chinese threat actor was detected targeting the strategic infrastructure projects of government organizations in Indonesia, Thailand, and Vietnam. Active since late 2022, the campaign uses spear-fishing emails for initial access and deploys the Soul malware framework once inside the network.