Overview

• Google detailed a March campaign that hijacked Wi‑Fi access, used social engineering with a fake Adobe plug‑in, and deployed a memory‑resident backdoor called SOGU.SEC.
• About two dozen victims downloaded the malware, according to Google security engineer Patrick Whitsell, who did not disclose the nationalities of those targeted.
• Google said it alerted impacted users and did not quantify what data, if any, was exfiltrated from compromised devices.
• The company attributed the activity to UNC6384 and, in its blog post, described links it believes associate the cluster with the China‑linked group known as Mustang Panda or TEMP.Hex.
• China’s foreign ministry said it was unaware of the specific case and accused Google of previously spreading false information, as the disclosure adds to ongoing US‑China cybersecurity tensions.