Multiple China-aligned threat clusters are conducting active espionage operations against government agencies, defense organizations, journalists, and diaspora activist groups across South, Southeast, and East Asia, as well as Poland. The clusters exploit unpatched Microsoft Exchange and IIS servers to deploy persistent backdoors, while parallel credential-harvesting campaigns target civil society organizations via phishing. Organizations in targeted sectors face elevated risk of undetected long-term network compromise, data exfiltration, and operational intelligence loss.