Chinese-Linked Hackers Deploy Linked Zero-Day Chain in Ongoing Espionage Campaign

Proofpoint's threat‑intelligence team has identified a coordinated campaign in which at least four Chinese‑aligned hacking groups have been chaining three distinct zero‑day vulnerabilities to infiltrate networks of interest to the Chinese government. The operation, observed from late August onward, leverages the sequential exploitation of the flaws to move laterally across compromised systems, allowing prolonged surveillance and data exfiltration.

The three vulnerabilities, each affecting different software layers, are linked in what analysts describe as a "triple‑link" chain. The first zero‑day grants initial access, the second provides privilege escalation, and the third enables stealthy persistence. By chaining the exploits, the groups avoid detection mechanisms that typically flag single‑step attacks, complicating defensive response.

Among the actors involved, the group designated TA412 by Proofpoint stands out for its sophisticated operational tempo and target selection. While the full roster of affected entities has not been disclosed, the campaign appears to focus on sectors that align with Beijing's strategic priorities, including technology firms, research institutions, and government‑linked organizations. The use of multiple groups suggests a coordinated effort to diversify risk and increase the likelihood of successful infiltration.

Security researchers note that the discovery underscores the growing prevalence of state‑sponsored actors employing advanced zero‑day arsenals. Zero‑day exploits are prized for their rarity and potency, and chaining them magnifies their impact. The findings also raise concerns about the supply‑chain security of the software components involved, prompting vendors to accelerate patch development and distribution.

Proofpoint has alerted affected parties and recommended immediate mitigation steps, such as applying available patches, implementing robust network segmentation, and deploying behavior‑based detection tools that can spot anomalous activity beyond signature matches. The agency continues to monitor the campaign, warning that additional zero‑day chains could emerge as threat groups refine their tactics. Stakeholders are urged to maintain heightened vigilance as the landscape of state‑backed cyber espionage evolves.