Nation-State critical China (PRC)

Weaver Ant

China-nexus (Sygnia). Attribution rests on GMT+8 working-day activity, China Chopper use, the ORB network and a backdoor overlap with reported Chinese APT activity; Sygnia says a false flag cannot be ruled out · Telecommunications infrastructure espionage / signals intelligence collection / long-duration persistent access

Reports 1

Active Since Over four years before the March 2025 report (Sygnia gives no date; "2021" is an inference)

Last Reported 8 Jul 2026

Sectors Targeted communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

Initial access via compromised externally facing servers (T1190), per Sygnia; not via the Zyxel routers
China Chopper variants in ASPX, PHP and VB using AES, with parameters named "password", "key" and "pass" to evade WAF logging
INMemory: loads a GZipped, Base64 eval.dll into memory and runs payloads via JScript, leaving no on-disk artefact
ReGeorg-style recursive HTTP tunnelling and web shells chained across hosts for lateral movement
Operational relay network using Zyxel CPE routers (mostly firmware VMG3625-T20A) run by Southeast Asian telcos, pivoting from one telco's device to target another
Defence evasion: patched ETW, overwrote AmsiScanBuffer in amsi.dll, loaded PowerShell through System.Management.Automation.dll without powershell.exe
Tooling includes Invoke-SMBClient (NTLM hashes), Invoke-SharpView (AD reconnaissance) and Invoke-ZIP (staging)
Persistent re-access after remediation across a four-plus year engagement

Known Targets

A major telecommunications company in Asia (campaign across tens of servers)Southeast Asian telecommunications operators whose Zyxel CPE devices were used as relays

Analyst Notes

Exposed by Sygnia on 24 March 2025 after an incident response engagement at an Asian telecommunications provider. Some press suggests it may operate alongside Velvet Ant and Salt Typhoon; Sygnia is tentative and the names are not merged here. CORRECTED to match Sygnia's ATT&CK mapping: T1055 and T1041 were removed (Sygnia lists T1048 for exfiltration) and Proxy is T1090.001 (Internal Proxy). No 2026 reporting found; Singapore's IMDA published an advisory on the activity (not reviewed).

Also Known As

Weaver Ant (Sygnia designation)

MITRE ATT&CK Techniques

T1190 Exploit Public-Facing Application T1505.003 Web Shell T1059.001 PowerShell T1059.007 JavaScript T1078.002 Domain Accounts T1134.001 Token Impersonation/Theft T1003.002 Security Account Manager T1087.002 Domain Account T1021.001 Remote Desktop Protocol T1570 Lateral Tool Transfer T1560.001 Archive via Utility T1074.001 Local Data Staging T1572 Protocol Tunneling T1090.001 Internal Proxy T1048 Exfiltration Over Alternative Protocol

Intelligence Reports

Analysis communicationscritical-infrastructure

Weaver Ant: The China-Nexus APT That Lived Inside a Telecom for Four Years

Sygnia's exposure of Weaver Ant reveals a China-aligned threat actor that maintained persistent access inside an Asian telecommunications provider for more than four years, using an AES-encrypted China Chopper variant, a novel in-memory web shell, and an ORB network built from compromised telco routers.

8 Jul 2026 · 12 min read