Researchers identified a Chinese cyber-espionage group that has exchanged tools with Winnti Umbrella, APT 27, and Mustang Panda. The group has been observed using repurposed, publicly available malware in espionage campaigns throughout Asia since at least early 2022. The group could also be moonlighting as criminal hackers, as they have been observed attacking Chinese companies after typical work hours.