Silence As Strategy: Southeast Asia and China's Persistent Cyber Campaigns

Google’s revelation that China mounted a cyber-espionage campaign against Southeast Asian diplomats should surprise no one. State-sponsored cyber operations are a permanent feature of the region’s security landscape, and China has long been one of the most active players. The disclosure matters less for novelty than for clarity: confirmation from a trusted commercial actor that such campaigns are ongoing, targeted and sophisticated. It reinforces what security agencies already know, while providing a public narrative grounded in commercial insight rather than sensitive intelligence.

The campaign’s timing was telling. It coincided with tensions in the South China Sea, a Thai–Cambodian border clash and major regional events such as the Shangri-La Dialogue and meetings of the Association of Southeast Asian Nations. In these moments, Beijing had every incentive to monitor diplomatic conversations. Whether the campaign was narrowly tied to these events or part of a broader sweep remains unclear, but the logic is unmistakable: Southeast Asia’s diplomacy is of direct strategic importance to Beijing.

The campaign was attributed to a threat group called UNC6384. The group has been linked to Mustang Panda, which is one of China’s most relentless advanced persistent threats—actors that embed themselves in systems, remaining undetected for long periods of time. Active since at least 2012, Mustang Panda specialises in espionage and political intelligence gathering. It consistently targets governments, non-government organisations, think tanks and telecommunications companies, often exploiting backdoors in information and communications technology infrastructure. These are not opportunistic hacks, but rather structured campaigns aligned with Beijing’s strategic goals: shaping regional affairs, pre-empting policy shifts and sustaining intelligence advantages.

UNC6384’s latest operation began in March and focused on diplomats across several Southeast Asian states. Between 20 and 24 officials and staff were confirmed by Google to have downloaded malware, mostly in Southeast Asia. UNC6384 is known to exploit public wi-fi at hotels—a favoured vector for compromising officials on the move.

It has displayed hallmarks of a mature Chinese spying group: social manipulation, custom malware, network hijacking, execution of malware without using files, and use of trusted digital certificates. These techniques made detection difficult and ensured persistence. While the group’s specific sponsor within the Chinese government is unknown, UNC6384 likely sits within Mustang Panda’s ecosystem, which has documented ties to China’s Ministry of State Security.

Regional governments have so far declined to respond publicly, continuing a well-established pattern. Cyber-espionage is acknowledged as an unwelcome but routine element of statecraft, yet public attribution remains rare. In July, Singapore linked a campaign to actors with suspected Chinese ties but avoided naming Beijing. The Philippines has described several attacks as being ‘from China’ without attributing them to the Chinese government. Indonesia and Malaysia usually publish technical reports that trace attacks to infrastructure but stop short of identifying a sponsor. Attribution does occur, but selectively, cautiously and often by implication.

Three factors drive this restraint. The first is capability limits. Conclusive attribution demands more than technical forensics; it requires intelligence that only a handful of regional governments possess. Cybersecurity firms help fill the gap, but their assessments are often treated warily, given their commercial incentives and perceived biases.

The second is the absence of a crisis trigger. Espionage is undesirable but tolerable while it falls short of catastrophic disruption. Without a major incident—such as a crippling attack on critical infrastructure or a mass data breach with immediate consequences—leaders see little reason to escalate. Quiet management trumps confrontation.

The third is political caution. Most Southeast Asian states practice economic and diplomatic pragmatism and choose not to publicly raise sensitive issues. Publicly accusing China, an indispensable trade and investment partner of the region, risks retaliation that could outweigh the benefits of taking a principled stand.

Most governments also lack declared offensive cyber capabilities. Some, such as Indonesia and Cambodia, have explicitly rejected the militarisation of cyberspace. States therefore default to defence: strengthening cybersecurity agencies, building talent and updating legislation. Pace varies, but postures of resilience over retaliation are consistent.

What remains missing is an open public conversation about state-sponsored threats. Beyond Singapore and Malaysia, few governments provide regular updates or warnings. This opacity reduces awareness, limits accountability and sidelines civil society and the private sector in national cyber defence.

The UNC6384 campaign has underscored a larger truth: cyber-espionage is now a permanent feature of Southeast Asia’s security environment. As Indo-Pacific states expand their cyber capabilities, the region will remain a prime theatre for intelligence competition. These campaigns will persist and grow more sophisticated. The default response of quiet management and avoidance of escalation may preserve short-term calm but carries long-term dangers.

Without greater transparency and public engagement, states risk underestimating the scale of the challenge and failing to mobilise the necessary resources. State-sponsored cyber campaigns can no longer be dismissed as a nuisance or an accepted feat of international affairs: they’re too central to national security. These operations violate the principle of non-interference and are part of a deliberate strategy to undermine sovereign decision-making.

Gatra Priyandita is a senior analyst in ASPI’s Cyber, Technology and Security Program.

This article appeared originally at The Strategist (ASPI).