Operation FishMedley is a China-aligned FishMonger APT campaign targeting governments and think tanks globally.
Operation FishMedley is attributed to the China-aligned FishMonger APT group. This actor targets governments, NGOs, and think tanks across Asia, Europe, and the United States. Key TTPs include the use of implants such as ShadowPad, SodaMaster, and Spyder. Defenders should focus on detecting traces of these specific implants and behaviors characteristic of China-aligned APT groups.
Verticals targeted during Operation FishMedley include governments, NGOs, and think tanks, across Asia, Europe, and the United States. ; Operators used implants – such as ShadowPad, SodaMaster, and Spyder – that are common or exclusive to China-aligned threat actors. ; We assess with high confidence that Operation FishMedley was conducted by the FishMonger APT group.
Operation FishMedley targets governments, NGOs, and think tanks across Asia, Europe, and the United States.
Operation FishMedley is associated with the ShadowPad, SodaMaster, and Spyder implants.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.