Do Son A misconfiguration exposed APT41 tools targeting Shiseido, revealing Fortinet exploit scripts, webshells, and reconnaissance tactics.
KEYPLUG
Sandman APT, identified as likely being China-based, is intricately linked to known threat clusters, including STORM-0866/Red Dev 40