Chinese State-Sponsored Group TA413 Adopts New Capabilities in Pursuit of Tibetan Targets

Recorded Future assesses that TA413, a likely Chinese state-sponsored actor, has actively targeted Tibetan-affiliated organizations in 2022 using both shared tooling (Royal Road RTF) and rapidly adopted zero-day exploits (Sophos Firewall CVE-2022-1040 and MSDT 'Follina' CVE-2022-30190) to deliver a custom backdoor named LOWZERO; the report provides detailed LOWZERO malware analysis, C2 protocol weaknesses, TTP mapping, and extensive IOCs to support detection and mitigation.