Threat operation UAT4356, also known as Storm-1849, which was behind the ArcaneDoor cyberespionage campaign that targeted Cisco firewalls and other vendors' perimeter network devices, has been associated with China following an investigation of the group's attack infrastructure, according to The Hacker News.
Article Link: ArcaneDoor attacks linked to Chinese threat actors | SC Media