Tag: china
-
China-Linked TA419 Hackers Target US AI Policy Experts With Credential Phishing Attacks
Tags: ai, attack, china, control, credentials, cyber, hacker, infrastructure, intelligence, microsoft, phishing, regulation, threatA China-linked threat actor known as TA419 has targeted U.S. artificial intelligence policy specialists through highly customized credential-phishing operations. This campaign, which involves impersonation, adversary-in-the-middle infrastructure, and a modified Browser-in-the-Browser toolkit, aims to steal Microsoft 365 sessions. This activity indicates a focused effort to collect intelligence on individuals who influence U.S. AI regulation, export controls,…
-
U.S. Arrests Company Owner Accused of Shipping $300 Million in Restricted GPU Servers to China
U.S. authorities have arrested Greg Lui, a 38-year-old California-based technology company owner, on allegations of orchestrating the illegal export of more than $300 million in advanced GPU-equipped servers to China through a network of overseas transshipment companies. Federal prosecutors claim that Lui, also known as Yiu Kong Lui, used false end-user documentation, intermediary companies, and…
-
Breach Roundup: Cisco SD-WAN Flaw Under Attack
OpenAI Agents Target Canada, ShinyHunters Suspect Arrested. This week: Cisco SD-WAN, OpenAI agents target Canada, ShinyHunters suspect arrested in Amsterdam, Japanese railway ransomware, AI labs investigated, an accused Chinese hacker misses his cellphone. Russian hackers, an ATM jackpotting network sanctioned and former airmen sentenced for BEC. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/breach-roundup-cisco-sd-wan-flaw-under-attack-a-33001
-
National cyber director: Government-industry collaboration vital to managing AI risks, competition with nations
Sean Cairncross talked about regulations, China, pilot projects and more Thursday. First seen on cyberscoop.com Jump to article: cyberscoop.com/sean-cairncross-ai-security-china-industry-collaboration/
-
Researchers find Chinese hacking campaigns targeting AI firms, Asian governments
Two separate reports by cybersecurity companies highlight China-linked hacking operations, including a phishing campaign that impersonated Western experts. First seen on therecord.media Jump to article: therecord.media/china-linked-phishing-scheme-backdoor-taiwan
-
AI policy circles targeted in China-linked phishing operation
Cybersecurity firm Proofpoint said TA419 impersonated officials and AI industry figures in an effort to gain access to cloud accounts held by U.S. think tank, university and legal-sector experts. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-cyber-espionage-ta419-phishing-us-ai-policy-experts/
-
China-Linked Hackers Impersonate AI Experts to Target US Policy Insiders
TA419 posed as AI policymakers and economists to phish US AI policy experts’ Microsoft 365 accounts First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/ta419-impersonates-ai-experts-us/
-
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/warlock-ransomware-spanish-portuguese
-
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional…
-
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional…
-
China-Nexus Hackers Compromise 350 Systems Across Asia With New Antino Backdoor
A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional…
-
OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates
OpenAI on Wednesday said it identified and disrupted a coordinated distillation campaign that was designed to illicitly extract protected reasoning from its artificial intelligence (AI) models.A “core cluster of the activity,” going back to the first week of July, has been attributed to individuals associated with Moonshot AI, a Chinese AI company based in Beijing.…
-
MI5 Warns Over 100 Academics Helped China’s Espionage Plans
MI5 has issued a rare warning to UK academics contributing to the China General Technology Research Institute First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mi5-alerts-academics-chinese/
-
OpenAI reveals ‘novel’ encryption bypass used in distillation attack
The company said individuals associated with Chinese company MoonshotAI were behind parts of the attack, but did not offer hard evidence for the claim. First seen on cyberscoop.com Jump to article: cyberscoop.com/openai-moonshot-ai-model-distillation-attack/
-
OpenAI Accuses Moonshot AI of Coordinated Model Distillation
Campaign Allegedly Used Thousands of Accounts to Extract Hidden Reasoning From OpenAI Models. OpenAI disrupted what it calls a coordinated campaign to extract the training data and reasoning of its AI models, allegedly by the developer of the Kimi model, Chinese company Moonshot AI. The company first noticed the activity in July. First seen on…
-
China-nexus UAT-11587 targets government and policy organizations across Asia with Antino backdoor
Cisco Talos uncovered a cluster of activity we track as UAT-11587 targeting government and policy organizations across Asia, including in Taiwan, India, the Philippines, and Cambodia, to deliver a previously undocumented backdoor referred to as “Antino” in developer artifacts. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/china-nexus-uat-11587-targets-government-and-policy-organizations-across-asia-with-antino-backdoor/
-
‘NeedyMantis’ Provides Long-Term Access to Compromised Networks
Microsoft observed a China-based actor using a previously unidentified malware framework in targeted intrusions against telcos, universities, medical, and government-related organizations. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/needymantis-long-term-access-compromised-networks
-
Microsoft Warns NeedyMantis Malware Enables Persistent Network Access
Microsoft Threat Intelligence warns that NeedyMantis threat actor from China has targeted organizations across a range of industries First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/microsoft-needymantis-malware/
-
Forschungskooperationen mit China – IT-Zentrum Cispa hat Daten nicht ausreichend geschützt
Tags: chinaFirst seen on security-insider.de Jump to article: www.security-insider.de/cispa-pruefer-kritisieren-datenschutz-china-kooperation-a-69d8999269504ae0b9079a49e8d859e4/
-
Nach KI-Vorfällen: China und USA richten KI-Kommunikationskanal ein
China und die USA ringen um die Vorherrschaft bei der KI-Entwicklung. Dennoch wollen beide Länder sich über Zwischenfälle gegenseitig informieren. First seen on golem.de Jump to article: www.golem.de/news/nach-ki-vorfaellen-china-und-usa-richten-ki-kommunikationskanal-ein-2609-213468.html
-
Breach Roundup: Thousands of AI Relays Hide China Users
Tags: ai, breach, china, cisa, cve, cybercrime, data, data-breach, flaw, google, jobs, north-korea, russia, scam, vpnAlso, CISA Ends Weekly CVE Bulletin After 22 Years, Check Point VPN Flaw Exploited. This week: AI relay servers connect to China, CISA ends weekly CVE bulletin, cybercriminal guilty pleas and sentences, drug dealers hijack Google Maps, Russian Burger King customers’ data leaked, North Korean fake job scams, SectopRAT, a Check Point VPN flaw and…
-
Lawmakers introduce bill for voluntary telecom cyber rules after Salt Typhoon hacks
U.S. Sens. Mark Warner (D-VA) and Ted Cruz (R-TX) introduced the Telecommunications Cybersecurity and Resilience Act on Thursday, arguing that the new effort was necessary in light of the Salt Typhoon attacks which saw Chinese hackers breach nearly all of the major telecommunications giants in the U.S. First seen on therecord.media Jump to article: therecord.media/lawmakers-introduce-bill-for-voluntary-telecom-cyber-rules
-
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/
-
Volexity spots another China-aligned threat group exploiting Chrome and Microsoft defects
The threat group Volexity tracks as UTA0565 showcased a variance in tactics, but it used the same exploit kit as multiple Chinese threat groups. First seen on cyberscoop.com Jump to article: cyberscoop.com/volexity-uta0565-china-exploit-chain-chrome-microsoft/
-
Citing China, President Trump doubles down on hands-off approach to AI regulation
Following a series of chaotic agentic hacks, Trump and administration officials have consistently expressed fears of Chinese AI dominance in pushing for fewer regulations. First seen on cyberscoop.com Jump to article: cyberscoop.com/trump-hands-off-ai-regulation-china-race/
-
Attacker compromised nearly 1000 Zyxel switches since August (CVE-2026-7273)
A Chinese-speaking threat actor has exploited a vulnerability (CVE-2026-7273) in unpatched ZyXEL GS1900 Smart Managed Switches and has exfiltrated sensitive data from 996 … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/22/zyxel-switches-cve-2026-7273-vulnerability-exploited/
-
Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome. It followed Volexity’s September 9 disclosure that UTA0560 and…
-
Hackers Exploit WordPress CVE-2026-63030 and CVE-2026-60137 to Steal Government Data
A suspected Chinese-speaking threat actor has exploited the critical WordPress “wp2shell” vulnerability chain to compromise government and small-business targets across 29 countries, stealing at least 18,566 sensitive records from one Western government organization. GreyNoise linked the activity to a malicious cyber actor (MCA) it has tracked through its Global Observation Grid since early June. The…
-
China-Linked FamousSparrow Deploys SparroWocky Backdoor in Latin America
FamousSparrow is targeting Latin American governments with SparroWocky, a new C++ backdoor that exfiltrates files, takes screenshots and evades security tools. First seen on hackread.com Jump to article: hackread.com/china-famoussparrow-sparrowocky-backdoor-latin-america/
-
China-nexus actor steals thousands of documents in monthslong exploitation campaign
Researchers suspect the hacker employed LLMs to develop custom tools. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-nexus-steals-thousands-documents-exploitation/830902/