Tag: china
-
Sunken Ships: Will Orgs Learn From Ivanti EPMM Attacks?
The April/May zero-day exploitations of Ivanti’s mobile device management platform meant unprecedented pwning of thousands of orgs by a Chinese APT, and history will probably repeat itself. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/sunken-ships-ivanti-epmm-attacks
-
DarkSpectre Malware Campaign Hits Chrome, Edge, and Firefox Users
A sophisticated Chinese threat actor dubbed DarkSpectre has compromised 8.8 million users across Chrome, Edge, and Firefox through three distinct malware campaigns that have operated undetected for over seven years, researchers revealed today. The operation represents one of the most extensive and professionally organized browser extension threats ever documented, combining long-term infrastructure investment with nation-state-level…
-
DarkSpectre Browser Extension Campaigns Exposed After Impacting 8.8 Million Users Worldwide
The threat actor behind two malicious browser extension campaigns, ShadyPanda and GhostPoster, has been attributed to a third attack campaign codenamed DarkSpectre that has impacted 2.2 million users of Google Chrome, Microsoft Edge, and Mozilla Firefox.The activity is assessed to be the work of a Chinese threat actor that Koi Security is tracking under the…
-
Best of 2025: NOTGreat Firewall: China Blocks the Web for 74 Min.
HTTPS connections on port 443 received forged”¯”¯replies. Chinese web users couldn’t access websites outside the People’s Republic yesterday. The outage lasted an hour and a quarter”, with no explanation. Nobody’s sure whether it was a mistake or an ominous test of new censorship capabilities. But some are linking it to a recent outage in Pakistan.…
-
Discovering the Dimensions of a New Cold War
The United States’ plan for dealing with Putin’s Russia and Xi’s China remains ill-defined among a shifting global order. That must change. First seen on wired.com Jump to article: www.wired.com/story/discovering-the-dimensions-of-a-new-cold-war/
-
MongoBleed (CVE-2025-14847): the US, China, and the EU are among the top exploited GEOs
MongoBleed (CVE-2025-14847) lets attackers remotely leak memory from unpatched MongoDB servers using zlib compression, without authentication. A critical vulnerability, CVE-2025-14847 (MongoBleed), was disclosed right after Christmas, an unwelcome “gift” for the cybersecurity community, impacting MongoDB Server deployments that use zlib network compression. MongoDB is a popular open-source NoSQL database used to store and manage data…
-
Chinese Hackers Deploy Rootkit to Stealthily Mask ToneShell Malware
Tags: apt, backdoor, china, cyber, cyberespionage, government, group, hacker, malicious, malware, technology, toolA sophisticated cyberespionage campaign leveraging kernel-mode rootkit technology has been discovered targeting government organizations across Southeast and East Asia, with Myanmar and Thailand bearing the brunt of attacks. Security researchers identified a malicious driver delivering the ToneShell backdoor, a hallmark tool of the Chinese-nexus HoneyMyte APT group, also tracked as Mustang Panda or Bronze President.…
-
Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver
China-linked APT Mustang Panda used a signed kernel-mode rootkit driver to load shellcode and deploy its ToneShell backdoor. China-linked APT Mustang Panda (aka Hive0154, HoneyMyte, Camaro Dragon, RedDelta or Bronze President) was observed using a signed kernel-mode rootkit driver with embedded shellcode to deploy its ToneShell backdoor. Mustang Panda has been active since at least 2012, targeting American and European entities such as…
-
React2Shell: Anatomy of a max-severity flaw that sent shockwaves through the web
What the research quickly agreed on: Across early reports from Wiz, Palo Alto Networks’ Unit 42, Google AWS, and others, there was a strong alignment on the core mechanics of React2Shell. Researchers independently confirmed that the flaw lives inside React’s server-side rendering pipeline and stems from unsafe deserialization in the protocol used to transmit component…
-
The Most Dangerous People on the Internet in 2025
From Donald Trump to DOGE to Chinese hackers, this year the internet’s chaos caused outsized real-world harm. First seen on wired.com Jump to article: www.wired.com/story/most-dangerous-people-on-the-internet-2025/
-
Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor
China-linked APT Evasive Panda used DNS poisoning to deliver the MgBot backdoor in targeted cyber-espionage attacks in Türkiye, China, and India. Kaspersky researchers spotted the China-linked APT group Evasive Panda (aka Daggerfly, Bronze Highland, and StormBamboo) running a targeted cyber-espionage campaign using DNS poisoning to deliver the MgBot backdoor against victims in Türkiye, China, and…
-
Interpol sweep takes down cybercrooks in 19 countries
Tags: access, antivirus, attack, botnet, business, china, cyber, cyberattack, cybercrime, cybersecurity, data, defense, email, encryption, finance, fraud, group, incident response, infrastructure, intelligence, international, interpol, law, malicious, malware, microsoft, ransomware, russia, scam, service, theft, threatA ‘very good thing’: The fact that the same operation broke ransomware operations and a business email compromise (BEC) operation is “unique,” said DiMaggio, because most people think of Africa as the source of BEC and fraud scams.The fact that authorities are working to disrupt ransomware operations in Africa before they grow to the size…
-
Chinese Crypto Scammers on Telegram Are Fueling the Biggest Darknet Markets Ever
Online black markets once lurked in the shadows of the dark web. Today, they’ve moved onto public platforms like Telegram”, and are racking up historic illicit fortunes. First seen on wired.com Jump to article: www.wired.com/story/expired-tired-wired-chinese-scammer-crypto-markets/
-
Chinese Crypto Scammers on Telegram Are Fueling the Biggest Darknet Markets Ever
Online black markets once lurked in the shadows of the dark web. Today, they’ve moved onto public platforms like Telegram”, and are racking up historic illicit fortunes. First seen on wired.com Jump to article: www.wired.com/story/expired-tired-wired-chinese-scammer-crypto-markets/
-
Kuaishou Cyberattack Disrupts Livestreaming, Triggers Sharp Stock Decline
Chinese short-video platform Kuaishou Technology saw its shares fall sharply after the company confirmed a cyberattack that briefly disrupted its livestreaming services, exposed users to inappropriate content, and rattled investor confidence. The Kuaishou cyberattack, which occurred late on Monday night, triggered the stock’s steepest single-day decline in more than two months and pushed it to…
-
Kuaishou Cyberattack Disrupts Livestreaming, Triggers Sharp Stock Decline
Chinese short-video platform Kuaishou Technology saw its shares fall sharply after the company confirmed a cyberattack that briefly disrupted its livestreaming services, exposed users to inappropriate content, and rattled investor confidence. The Kuaishou cyberattack, which occurred late on Monday night, triggered the stock’s steepest single-day decline in more than two months and pushed it to…
-
US Must Go on Offense in Cyberspace, Report Warns
Report: China, Russia Exploiting US Cyber Policy Gaps to Gain Strategic Advantage. A new McCrary Institute report urges Washington to adopt a more offensive cyber strategy, warning that the current reactive approach leaves the U.S. unable to counter China and Russia’s persistent campaigns to gain asymmetric leverage in cyberspace. First seen on govinfosecurity.com Jump to…
-
Datenübermittlungen nach China: ‘TikTok”-Betreiber muss Nutzer in der EU entsprechend informieren
Tags: chinaFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/datenuebermittlung-china-tiktok-betreiber-nutzer-eu-information
-
Hundreds of Cisco customers are vulnerable to new Chinese hacking campaign, researchers say
Cisco warned that Chinese government hackers are exploiting a zero-day in some of its products. Researchers now say there are hundreds of vulnerable Cisco customers. First seen on techcrunch.com Jump to article: techcrunch.com/2025/12/19/hundreds-of-cisco-customers-are-vulnerable-to-new-chinese-hacking-campaign-researchers-say/
-
UK Foreign Office Targeted by Hackers
Chinese Hacking Group Reportedly Behind the Hack. A top-ranking U.K. government official said that hackers targeted the government’s foreign relations ministry but dismissed media reports that the attackers stole a large trove of data. We managed to close the hole, as it were, very quickly, said Trade Minister Chris Bryant. First seen on govinfosecurity.com Jump…
-
UK Foreign Office Targeted by Hackers
Chinese Hacking Group Reportedly Behind the Hack. A top-ranking U.K. government official said that hackers targeted the government’s foreign relations ministry but dismissed media reports that the attackers stole a large trove of data. We managed to close the hole, as it were, very quickly, said Trade Minister Chris Bryant. First seen on govinfosecurity.com Jump…
-
10 Major Cyberattacks And Data Breaches In 2025
Among the major cyberattacks and data breaches in 2025 were nation-state infiltration by China and North Korea, as well as massive data theft and ransomware attacks. First seen on crn.com Jump to article: www.crn.com/news/security/2025/10-major-cyberattacks-and-data-breaches-in-2025
-
LongNosedGoblin Caught Snooping on Asian Governments
New China-aligned APT group is deploying Group Policy to sniff through government networks across Southeast Asia and Japan. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/longnosedgoblin-caught-snooping-on-asian-governments
-
UK Foreign Office Cyber Breach Exposed Diplomatic Secrets
The government stopped short of directly attributing the attack to Chinese operatives or the Chinese state. The post UK Foreign Office Cyber Breach Exposed Diplomatic Secrets appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-uk-foreign-office-cyber-breach/
-
Chinese Hackers Target Cisco’s Email Security Systems
The Chinese threat group, tracked as UAT-9686, has deployed a collection of custom-built hacking tools to maintain persistent access to compromised systems. The post Chinese Hackers Target Cisco’s Email Security Systems appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-cisco-email-security-breach/
-
UK politics: ‘Not clear’ who was behind FCDO hack, says minister, amid reports of China link as it happened
Chris Bryant confirms October cyber-attack as the Sun names Storm 1849, a Chinese hacker group, as being responsible The BBC’s editing guidelines do not need to be altered in the wake of controversy surrounding the edit of a <strong>Donald Trump</strong> speech, a review has found.The US president is seeking up to $10bn (£7.5bn) in damages…