Tag: china
-
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
-
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
Researchers say the hacker is harvesting credentials and stealing sensitive information. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/
-
Zero-Day in BeyondTrust Remote Support Appliances Exploited
‘Patch ASAP’ Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns. All self-hosted BeyondTrust Remote Support appliance users are being urged to immediately patch a bug that an advanced persistent threat group tied to China, which specializes in hacking edge devices. Its been exploiting since late August as a zero-day vulnerability to steal credentials and…
-
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks. First seen on therecord.media Jump to article: therecord.media/beyond-trust-cyberattack-china
-
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Tags: china, credentials, cyber, email, finance, fraud, infrastructure, international, malicious, microsoft, phishing, service, theftMicrosoft and international partners have disrupted infrastructure supporting CoGUI. This phishing kit Proofpoint says generates more than 100 million malicious emails monthly. The coordinated action targeted a Chinese-speaking fraud ecosystem encompassing related phishing kits, infrastructure providers, and services enabling credential theft and financial fraud. Microsoft and Health-ISAC filed a civil lawsuit in the U.S. District…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages
Microsoft and partners reveal a major Chinese-language phishing network centered around the Yam Store marketplace First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-yam-store-one-billion/
-
Microsoft Takes Down Massive Chinese Phishing Marketplace
Tags: china, cybercrime, healthcare, infrastructure, malicious, marketplace, microsoft, network, phishing, serviceChinese-Language Phishing Services Sent 1 Billion Malicious Messages in 2026. A network of major Chinese-language phishing sites used by cybercriminals to impersonate tens of thousands of global corporations had their infrastructure seized following a U.S. court order sought by Microsoft and healthcare organization Health-ISAC. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/microsoft-takes-down-massive-chinese-phishing-marketplace-a-33107
-
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea’s fraudulent remote IT worker (ITW) scheme.The indictment charges a mix of U.S. citizens and Chinese nationals for their roles in an IT worker conspiracy affecting more than 70 U.S.…
-
Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the infrastructure underlying YAM Store, CoGUI and Iron Man. First seen on therecord.media Jump to article: therecord.media/microsoft-takes-down-3-major-chinese-phishing-platforms
-
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
In less than 10 months, cybercriminals used the arsenal of customized, targeted phishing kits to send more than 1 billion malicious messages to more than 75,000 organizations globally. First seen on cyberscoop.com Jump to article: cyberscoop.com/microsoft-disrupts-chinese-language-phishing-kit-ecosystem/
-
Why It May Take a Crisis to Move Congress on Cyber Liability
Report Authors Warn Federal Cyber Mandates Likely Won’t Progress Without Disaster. It may take a disaster before Congress makes technology vendors liable for insecure products or mandates baseline security for critical infrastructure, say cybersecurity policy professionals who call for both measures as a counter to China’s threat to American networks. First seen on govinfosecurity.com Jump…
-
ARTEX AI, Claude agents used in cyberattacks on South Korean banks
The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/
-
FBI seizes domains linked to China-nexus botnet
The infrastructure supported an international hacking campaign that targeted critical infrastructure, including a South Carolina-based power company. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-seizes-domains-china-botnet-flax-typhoon/832611/
-
FBI seizes domains linked to China-nexus botnet
The infrastructure supported an international hacking campaign that targeted critical infrastructure, including a South Carolina-based power company. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/fbi-seizes-domains-china-botnet-flax-typhoon/832611/
-
$10 million bounty offered for Chinese Hafnium hacker accused of Microsoft Exchange Server mega-attack
The US State Department is offering up to US $10 million for information about the whereabouts of Zhang Yu, a 44-year-old Chinese national who is accused of being a key figure in China’s state-sponsored hacking group, Hafnium. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/10-million-bounty-chinese-hafnium-hacker-microsoft-exchange-server-mega-attack
-
The Cyber Express Weekly Roundup: US Puts $10 Million Bounty on Chinese Hacker, Japan Moves to Hunt Hidden Attackers and More
This weekly roundup covers a massive exposure of personal data from Denmark’s national population register, a U.S. bounty on a Chinese hacker accused of stealing COVID-19 research, Japan’s plan to actively search for attackers hiding in its critical infrastructure, a pair of breaches at Japanese publisher Nikkei, a call for AI-driven decision-making in security operations,…
-
TP-Link Sued by Four More U.S. States Over Router Security and China Ties
Four more U.S. states sued router maker TP-Link Systems on October 6, bringing the total to five, with Texas filing a suit in February. Florida, Iowa, Montana and Nebraska allege the California company misled buyers about how secure its routers are and how separate it is from China. TP-Link denies the claims and says it…
-
Flax Typhoon Exploits Five Flaws as CISA Sets October 11 Deadline for Federal Agencies
Tags: access, china, cisa, control, cve, cybersecurity, exploit, flaw, infrastructure, kev, threat, vulnerabilityThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added five security flaws to its Known Exploited Vulnerabilities (KEV) catalog, following their abuse by a China-linked threat actor known as Flax Typhoon.The vulnerabilities in question are listed below – CVE-2015-3306 (CVSS score: 10.0) – An improper access control vulnerability in ProFTPD that could allow…
-
US Disrupts China-Linked Integrity Tech ‘s Cyber Espionage Tools
DOJ and FBI seized China-linked hacking tools Microscan and FishHub, linked to Integrity Tech and attacks on critical infrastructure worldwide. The Justice Department and FBI took down two hacking tools this week, Microscan and FishHub, both built and run by a Beijing-based company with direct government contracts. The tools were used to scan, and in…
-
FBI disrupts Flax Typhoon hacking tools used in global cyberattacks
The FBI seized seven domains used to operate Microscan and FishHub, two hacking tools linked to Chinese state-sponsored hackers known as Flax Typhoon that were used to target … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/09/fbi-flax-typhoon-microscan-fishhub-domains/
-
UK and Allies Warn of Cyber Threat from China’s Integrity Technology Group
The UK, US and allies have issued an alert detailing malicious activity linked to China’s Integrity Technology Group First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/uk-allies-threat-china-integrity/
-
FBI Seizes 7 Domains, Disrupts Flax Typhoon Tools Used in Critical Infrastructure Intrusions
The U.S. Federal Bureau of Investigation (FBI) and Department of Justice (DoJ) have announced the disruption of malicious tools used by a China-linked advanced persistent threat group known as Flax Typhoon.To that end, the agencies seized several domains and blocked access to platforms that were used to scan, and in some cases infiltrate, U.S. critical…
-
FBI Warns Chinese Hackers Use Automated Tools and Botnets to Steal Sensitive Data
Tags: advisory, botnet, china, cyber, cybersecurity, data, exploit, government, group, hacker, healthcare, infrastructure, international, technology, tool, vulnerabilityThe FBI and international cybersecurity agencies have warned about hackers linked to the Chinese government who use automated vulnerability scanning, large-scale botnets, and hands-on exploitation to steal sensitive information worldwide. A joint advisory released on October 8, 2026, identified China-based Integrity Technology Group as a facilitator of operations targeting critical infrastructure, government agencies, healthcare systems,…
-
FBI Seizes Flax Typhoon Hacking Tools Linked to Chinese Contractor
The FBI and DOJ seized domains and disrupted scanning and spear-phishing tools used by Flax Typhoon, a China-linked… First seen on hackread.com Jump to article: hackread.com/fbi-seizes-flax-typhoon-hacking-tools-china/
-
FBI Seizes Domains Used in Flax Typhoon Attacks
US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft. The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advisory urges organizations to hunt for lingering access. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049
-
FBI Seizes Domains Used in Flax Typhoon Attacks
US Authorities Say Infrastructure Supported Scanning, Phishing and Data Theft. The FBI seized seven domains allegedly used by China-linked hackers to scan critical infrastructure, deliver malware and steal files. A joint advisory urges organizations to hunt for lingering access. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/fbi-seizes-domains-used-in-flax-typhoon-attacks-a-33049