Tstark
- First seen
- 2020-06-01 00:00:00
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:18:17
Targeted industries: technology-and-telecommunications government-and-public-sector
Targeted regions: country_code:cn country_code:hk
Context
TStark is a threat actor identified by X-Ops, associated with a cluster of devices that executed the bookmark buffer overflow exploit targeting CVE-2020-15069 (T1203). The actor exhibited odd telemetry behavior indicative of intermittent VPN usage, switching between IP addresses geolocated to Hong Kong and Chengdu. Analysis revealed malware samples for Mac OS X and iOS, as well as IFRAME injection code exploiting a WebAssembly vulnerability (T1189). Additionally, TStark was linked to the development of libsophos.so and the deployment of malicious payloads across their devices.
Exploited vulnerabilities
- CVE-2020-15069 (vulnerability)
Reports & references
- news.sophos.com — Pacific Rim Timeline (report)