Symantec researchers observed Chinese state-sponsored threat actors running ransomware against an Asian software and services firm They claim it's highly unusual activity for state attackers The attackers demanded $2 million in ransom Emperor Dragonfly, a known Chinese state-sponsored threat actor, recently did something unusual – it deployed a ransomware encryptor on a target’s network. A report from Symantec’s Threat Hunter Team, which observed the attack in late 2024, noted how they had observed, on multiple occasions, the group doing what it usually does – side-loading malicious DLL files (via a legitimate Toshiba executable) to drop backdoors and establish persistence. The…