A cyber-espionage campaign documented in 2022 demonstrated how a seemingly ordinary visit to a news website can become an opportunity for digital reconnaissance. Researchers from Proofpoint and PwC identified activity that used emails impersonating an Australian news outlet to direct selected recipients to a deceptive website delivering ScanBox, a JavaScript-based reconnaissance framework.

The campaign was active from April through mid-June 2022, according to the researchers' joint investigation published on August 30 that year. Their analysis linked the activity to TA423, also known as Red Ladon, with moderate confidence. The research described targeting that included Australian government entities, organisations connected to offshore energy exploration in the South China Sea, and other international interests.

The significance of the operation lies in its approach. Instead of relying exclusively on conventional malware files, the attackers used a browser-based framework to collect information about selected visitors. That information could help them assess targets and inform subsequent espionage activity.

Why the date matters: this article examines a documented 2022 campaign and its defensive lessons. The available reporting does not establish that the same operation is currently active in October 2026.

How the campaign attracted its targets

According to Proofpoint and PwC, the campaign used targeted emails with subjects including “Sick Leave,” “User Research” and “Request Cooperation.” Some messages purported to come from someone associated with a fictional outlet called Australian Morning News and encouraged recipients to visit its website.

The website presented material resembling legitimate news coverage, including content copied from established media outlets. This helped the site appear relevant to the people the attackers wanted to reach. Once a selected visitor arrived, the page could deliver the ScanBox JavaScript framework.

There is an important distinction between this operation and a conventional watering-hole attack. A watering-hole strategy often involves compromising a legitimate website already visited by intended targets. In the 2022 campaign described by Proofpoint and PwC, researchers reported an attacker-controlled website impersonating a news outlet. It would therefore be misleading to claim that the attackers necessarily hacked the genuine websites whose content they imitated.

The broader lesson is that a familiar-looking page, a credible topic or professional presentation is not sufficient evidence that a website is authentic. Attackers can create convincing imitations and distribute links through carefully tailored messages.

What ScanBox does

ScanBox is a modular, JavaScript-based reconnaissance and exploitation framework that has appeared in threat research since at least 2014. It can collect information about a visitor's browser and computing environment and, depending on the modules deployed, support additional collection or follow-on activity.

Unlike malware that must first be installed as a conventional executable file, browser-based JavaScript can run when a user loads a page. This does not make the technique invisible or impossible to detect, but it changes where defenders need to look: web traffic, browser behaviour, scripts and connections to suspicious infrastructure can all become relevant evidence.

Proofpoint and PwC's analysis of the 2022 campaign described reconnaissance functions and modules associated with collecting browser and system information. The research also discussed keylogging functionality. In this context, keylogging means capturing keystrokes entered while the relevant malicious script is active in the browser; it should not be interpreted as proof that the framework automatically records everything a victim types across every application on their device.

The information collected can help an operator understand whether a visitor is of intelligence value. Details about the browser, operating environment or activity on the page may help attackers select targets for further attention. That is a different claim from saying ScanBox automatically maps an entire corporate network or grants direct access to internal systems.

Why reconnaissance can be valuable to an espionage operation

Cyber-espionage campaigns often depend on selecting targets carefully rather than compromising as many systems as possible. An initial reconnaissance stage can help an operator decide which people, organisations or technical environments warrant additional effort.

For a campaign focused on government and maritime or energy interests, even modest information can be useful when combined with other intelligence. A visitor's role, the organisation they represent, their technical environment or their interaction with a lure may help the attacker refine later targeting.

However, reconnaissance does not necessarily mean that a full intrusion has occurred. A person visiting a malicious page may expose some browser-level information without the attacker gaining control of the person's computer or accessing an organisation's internal network. The actual consequences depend on the code delivered, the browser's protections, the data entered and any additional exploitation that follows.

This distinction is important for incident response. Security teams should investigate what information may have been collected and whether subsequent activity occurred rather than treating every visit as proof of a complete network compromise.

Who was targeted, and how certain is the attribution?

Proofpoint and PwC described targeting across Australia, Malaysia and Europe, including organisations associated with offshore energy projects in the South China Sea. The research also discussed Australian government and media entities, as well as other sectors with regional strategic significance.

The researchers assessed with moderate confidence that the campaign was associated with TA423, also tracked as Red Ladon. Public reporting uses overlapping names for several threat clusters, including APT40 and Leviathan. These labels are not always interchangeable across every vendor or investigation, so readers should pay attention to the attribution language used in each report.

The researchers' assessment drew on the campaign's targeting patterns, infrastructure and similarities with earlier activity. Attribution in cybersecurity is an analytical judgment, not necessarily a definitive identification of the individuals behind an operation. For that reason, this article uses “linked with moderate confidence” rather than presenting the attribution as an independently proven fact.

Proofpoint also discussed the group's longer history of targeting organisations connected with government, defence, manufacturing, maritime affairs and other sectors. That history provides context for the 2022 activity, but it does not establish that every organisation in those sectors was targeted in this particular campaign.

What organisations should learn from the operation

The campaign offers several practical lessons for organisations that handle sensitive government, research, energy or commercial information. Defences should address the entire chain—from the initial email to the browser and any subsequent suspicious activity—rather than relying on a single security product.

1. Treat unexpected links as an identity-verification problem

Employees should be cautious when an unfamiliar sender asks them to visit a news site, review a document or provide information related to their work. A message can be well written and still be deceptive. Where a request is unexpected, verify the sender and the destination using a separate, trusted channel.

2. Use layered browser and endpoint protection

Endpoint detection and response tools can help identify suspicious processes, connections and post-exploitation activity. Secure web gateways, DNS filtering and browser protections can reduce access to known malicious destinations. These controls should complement one another: no single tool should be assumed to detect every malicious script.

3. Monitor suspicious web destinations and script behaviour

Security teams should investigate unusual outbound connections, newly registered or lookalike domains, and unexpected JavaScript activity where suitable telemetry is available. Detection rules should be based on reliable threat intelligence and validated against the organisation's environment to reduce false positives.

4. Limit the information available to a compromised browser

Organisations should enforce least privilege, keep browsers and operating systems updated, and restrict access to sensitive services according to role. Network segmentation can reduce the opportunities available to an attacker after a device is compromised, although it does not prevent all browser-based reconnaissance.

5. Prepare an investigation workflow

If a user visits a suspected malicious site, responders should preserve relevant email headers, URLs, browser and endpoint telemetry, DNS records and proxy logs where available. They should determine whether the page executed scripts, whether sensitive information was entered and whether there were suspicious connections or follow-on events.

Organisations should avoid assuming either that nothing happened or that a full compromise occurred solely because a link was opened. The evidence should determine the response, including whether credentials need to be reset, endpoints isolated or affected accounts investigated.

Why traditional security awareness is not enough

Training employees to recognise phishing remains useful, but sophisticated campaigns can exploit legitimate work patterns. A request to read a news story or review regional developments may be plausible for a person working in government, energy, maritime affairs or international business.

Organisations should therefore design security controls around the assumption that some deceptive links will be clicked. Email filtering, browser isolation where appropriate, endpoint monitoring, restricted privileges and effective incident response can reduce the impact of an error without depending entirely on user vigilance.

Security exercises should also reflect the organisation's actual exposure. Staff who routinely work with external partners, sensitive policy matters or regional intelligence may need tailored scenarios that teach them how to verify unexpected requests without obstructing legitimate work.

What this case does not prove

The public research documents a campaign, its reported targeting and the technical role of ScanBox. It does not establish that every recipient who received a lure was infected, that every visitor had sensitive information stolen, or that the campaign resulted in a confirmed breach at every targeted organisation.

Nor does the historical report prove that the same infrastructure or campaign remains operational today. Domains, hosting arrangements and attacker techniques can change. Current threat assessments require updated telemetry and research rather than assumptions based solely on a 2022 report.

Maintaining these boundaries makes the findings more useful. Security teams can take the demonstrated techniques seriously while keeping incident decisions grounded in evidence.

Frequently asked questions

What is TA423?

TA423, also known as Red Ladon, is a threat actor tracked in cybersecurity reporting for espionage-related activity. Proofpoint and PwC linked the 2022 ScanBox campaign to TA423 with moderate confidence.

What is ScanBox?

ScanBox is a modular, JavaScript-based reconnaissance and exploitation framework. Depending on the modules used, it can gather information about a visitor's browser and system environment and support further activity, including keylogging in the browser.

Was the 2022 campaign a watering-hole attack?

It used a related strategy of directing intended targets to a deceptive website. In the campaign described by Proofpoint and PwC, the reported site impersonated an Australian news outlet and was controlled by the attackers; the researchers did not describe this specific site as a genuine news website that had necessarily been compromised.

Did ScanBox automatically compromise an entire corporate network?

No such conclusion follows from the public report. ScanBox provided reconnaissance capabilities, but a full network intrusion would depend on additional access, vulnerabilities, credentials or follow-on activity.

Is this campaign still active in 2026?

The sources cited here document activity from April through mid-June 2022. They do not, by themselves, confirm that the same campaign remains active in 2026.

Sources and references

1. Raggi, M., & Scenarelli, S. (2022, August 30). Cyber Espionage in the South China Sea. Proofpoint, with research assistance from PwC Threat Intelligence. Read the original threat research.
2. Nelson, N. (2022, August 30). Watering Hole Attacks Push ScanBox Keylogger. Threatpost. Read the news report.
3. Cybersecurity and Infrastructure Security Agency. Phishing Guidance: Stopping the Attack Cycle at Phase One. Review CISA guidance.
4. National Institute of Standards and Technology. Cybersecurity Framework (CSF) 2.0. Review the NIST framework.

Editorial note: This article is based on the 2022 campaign analysis published by Proofpoint and PwC and contemporaneous reporting by Threatpost. Attribution is presented with the confidence level used by the researchers. The article does not claim that the campaign is active today or that every targeted visitor suffered a compromise.

Source: Threatpost