The China-linked threat actor known as Sharp Panda has expanded their targeting to include governmental organizations in Africa and the Caribbean as part of an ongoing cyber espionage campaign.

"The campaign adopts Cobalt Strike Beacon as the payload, enabling backdoor functionalities like C2 communication and command execution while minimizing the exposure of their custom tools," Check Point said in a report shared with The Hacker News. "This refined approach suggests a deeper understanding of their targets."

The Israeli cybersecurity firm is tracking the activity under a new name Sharp Dragon, describing the adversary as careful in its targeting, while at the same time broadening its reconnaissance efforts.

The adversary first came to light in June 2021, when it was detected targeting a Southeast Asian government to deploy a backdoor on Windows systems dubbed VictoryDLL.

Subsequent attacks mounted by Sharp Dragon have set their sights on high-profile government entities in Southeast Asia to deliver the Soul modular malware framework, which is then used to receive additional components from an actor-controlled server to facilitate information gathering.