Tag: china
-
China’s botched Great Firewall upgrade invites attacks on its censorship infrastructure
Attempts to censor QUIC traffic create chance to block access to offshore DNS resolvers First seen on theregister.com Jump to article: www.theregister.com/2025/08/04/china_great_firewall_quic_security_flaws/
-
Security Affairs newsletter Round 535 by Pierluigi Paganini INTERNATIONAL EDITION
A new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. New Linux backdoor Plague bypasses auth via malicious PAM module China Presses Nvidia Over Alleged Backdoors…
-
China Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech Tensions
China questioned Nvidia over suspected backdoors in its H20 chips, adding to rising tensions in the tech fight between the U.S. and Beijing. China’s internet watchdog has summoned Nvidia over concerns that its H20 AI chips may contain hidden backdoors. Nvidia H20 chips are AI GPUs tailored for the Chinese market, based on Hopper architecture.…
-
China Investigates NVIDIA’s H20 Chips for Surveillance Risks
NVIDIA has been called in by Chinese regulators over claims that its H20 AI chip poses security risks, putting billions in potential sales at stake. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-china-investigates-nvidia-h20-chips-backdoor-security-risks/
-
Microsoft Blames ‘China-Based Threat Actor’ for SharePoint Attacks
A series of cyberattacks targeting Microsoft collaboration software, specifically SharePoint, have been linked to Chinese hackers and threat actors. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-microsoft-sharepoint-patch-failure-chinese-hackers/
-
Storm-2603 Deploys Custom Malware Using BYOVD to Bypass Endpoint Protections
Check Point Research (CPR) has delved into the operations of Storm-2603, a recently identified threat actor linked to Chinese advanced persistent threat (APT) groups, amid widespread exploitation of Microsoft SharePoint Server vulnerabilities known as >>ToolShell.
-
Chinese Threat Actors Hack 11,000 Android Devices to Deploy PlayPraetor Malware
Chinese-speaking threat actors have used the PlayPraetor Remote Access Trojan (RAT) to infiltrate more than 11,000 Android devices globally in a sophisticated Malware-as-a-Service (MaaS) operation. This allows for on-device fraud (ODF) by controlling the device in real time. First investigated by Cleafy Threat Intelligence in June 2025, the campaign impersonates legitimate Google Play Store pages…
-
China accuses US of exploiting Microsoft zero-day in cyberattack
The accusation, the latest from Beijing, says U.S. intelligence agencies attacked two Chinese military enterprises. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-accuses-us-of-exploiting-microsoft-zero-day-in-cyberattack/
-
ToolShell under siege: Check Point analyzes Chinese APT Storm-2603
Storm-2603 group exploits SharePoint flaws and uses a custom C2 framework, AK47 C2, with HTTP- and DNS-based variants named AK47HTTP and AK47DNS. Check Point Research is tracking a ToolShell campaign exploiting four Microsoft SharePoint flaws, linking it to China-nexus groups APT27, APT31, and a new cluster, Storm-2603. The researchers pointed out that Storm-2603’s goals remain…
-
Microsoft-Sicherheitslücke in Deutschland weit verbreitet
Tags: bug, china, cyberattack, cybersecurity, germany, infrastructure, microsoft, ransomware, risk, software, update, usa, vulnerabilityDie Gefahr ist noch nicht gebannt: Experten verzeichnen weiter steigende Infektionszahlen.Deutsche Unternehmen, Behörden und Bildungseinrichtungen sind in Europa am stärksten von der schwerwiegenden Schwachstelle in der Sharepoint-Software von Microsoft betroffen. Nach einer Analyse des europäischen Cybersecurity-Unternehmens Eye Security wurden bislang weltweit 396 infizierte Server in 145 Organisationen identifiziert 42 davon betreffen demnach Unternehmen, die in…
-
Over 17,000 SharePoint Servers Found Exposed Online, 840 Vulnerable to Active 0-Day Attacks
Tags: attack, china, cve, cyber, cybersecurity, data-breach, finance, government, healthcare, Internet, microsoft, threat, vulnerability, zero-dayA significant cybersecurity crisis has emerged with the discovery of over 17,000 Microsoft SharePoint servers exposed to internet-based attacks, including 840 systems vulnerable to a critical zero-day vulnerability that Chinese threat actors are actively exploiting. The vulnerability, designated CVE-2025-53770 and dubbed >>ToolShell
-
SentinelLabs uncovers China’s hidden cyber-espionage arsenal
CSOonline that the most important pieces of new information gleaned from the findings are that “China’s contracting ecosystem forces many companies and individuals to collaborate on intrusions. This means many China-based Advanced Persistent Threats (APTs) may actually contain many different companies with many different clients.”The nation’s diverse private sector offensive ecosystem, he said, “supports a…
-
Breach Roundup: Did China Have a Sneak Peek Into ToolShell?
Also: ToolShell Hits South Africa, Most Americans Are Online Fraud Victims. This week: Did China sneak a peek into ToolShell? ToolShell hacking in South Africa, Cisco flaws, an Arizona woman sentenced for aiding North Korea. Most Americans scammed online, a NASCAR data breach and a claimed data leak at France’s Naval Group. Orange telecom disrupted.…
-
Feds still trying to crack Volt Typhoon hackers’ intentions, goals
A CISA official said they’re looking at the potential impact and what to do about Chinese hackers penetrating U.S. critical infrastructure. First seen on cyberscoop.com Jump to article: cyberscoop.com/feds-still-trying-to-crack-volt-typhoon-hackers-intentions-goals/
-
Beijing summons Nvidia over alleged backdoors in China-bound AI chips
H20 silicon under the microscope after slipping through US export bans First seen on theregister.com Jump to article: www.theregister.com/2025/07/31/beijing_nvidia_backdoors/
-
Silk Typhoon spun a web of patents for offensive cyber tools, report says
US court docs reveal that infamous Chinese snoops filed IP papers like tax returns First seen on theregister.com Jump to article: www.theregister.com/2025/07/31/silk_typhoon_attack_patents/
-
Chinese Silk Typhoon Hackers File Over 10 Patents for Advanced Intrusive Hacking Tools
A SentinelLABS investigation has revealed that businesses linked to the Chinese advanced persistent threat (APT) group Hafnium, also known as Silk Typhoon, have submitted more than ten patents for highly intrusive forensics and data exfiltration methods. These patents, registered by firms named in recent U.S. Department of Justice (DOJ) indictments, detail offensive capabilities, including encrypted…
-
China Summons Nvidia Over Alleged Backdoor Risks in AI Chips
China’s top cybersecurity authority, the Cyberspace Administration of China (CAC), has officially summoned representatives from Nvidia to address alleged security vulnerabilities in its AI chips sold in the country. The specific focus is on Nvidia H20 chips, a custom version designed for the Chinese market amid strict U.S. export controls. First seen on thecyberexpress.com Jump…
-
Silk Typhoon Linked to Powerful Offensive Tools, PRC-Backed Companies
An unsealed indictment associated with the Chinese threat group shows its members worked for companies closely aligned with the PRC as part of a larger contractor ecosystem. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/silk-typhoon-powerful-offensive-tools-prc
-
32% of exploited vulnerabilities are now zero-days or 1-days
Russian and Iranian threat activity rises: The security industry attributes only some of the newly discovered exploits to known attacker groups, and only some of those groups have known countries of origin. As a result, statistics on the origin of attacks are not perfect.During the first half of 2025, 181 of CVEs added to the…
-
Patents by Silk Typhoon-linked company shed light on Beijing’s offensive hacking capabilities
Researchers have discovered more than 10 patents for powerful offensive cybersecurity technologies filed by a prominent Chinese company allegedly involved in Beijing’s Silk Typhoon campaign. First seen on therecord.media Jump to article: therecord.media/patents-silk-typhoon-company-beijing
-
Hafnium Tied to Advanced Chinese Surveillance Tools
A SentinelLabs report has revealed patents linked to firms aiding China’s cyber-espionage operations, exposing new capabilities First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/hafnium-chinese-surveillance-tools/
-
Chinese Firms Linked to Silk Typhoon Filed 15+ Patents for Cyber Espionage Tools
Chinese companies linked to the state-sponsored hacking group known as Silk Typhoon (aka Hafnium) have been identified as behind over a dozen technology patents, shedding light on the shadowy cyber contracting ecosystem and its offensive capabilities.The patents cover forensics and intrusion tools that enable encrypted endpoint data collection, Apple device forensics, and remote access to…
-
SharePoint Zero-Days Exploited to Unleash Warlock Ransomware
145 Organizations Compromised by China-Linked Ransomware Hackers and Others. Nearly 150 different organizations’ on-premises SharePoint servers have been exploited by attackers targeting the zero-day vulnerabilities now tracked as ToolShell, researchers warn. Early attacks have been attributed to China-linked groups, in some cases leading to Warlock ransomware infections. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/sharepoint-zero-days-exploited-to-unleash-warlock-ransomware-a-29073
-
Microsoft-Sicherheitslücke – China warnt vor ‘Diffamierung”
First seen on security-insider.de Jump to article: www.security-insider.de/china-warnt-nach-hacker-angriffen-auf-microsoft-software-a-8d896f95c7fed98fa2b30f4d1c286aba/
-
Microsoft Says SharePoint Attacks Now Include Ransomware
A China-linked threat actor has been observed exploiting SharePoint servers to deliver ransomware, according to Microsoft researchers, in the latest sign of worsening attacks against on-premises SharePoint Server customers. First seen on crn.com Jump to article: www.crn.com/news/security/2025/microsoft-says-sharepoint-attacks-now-include-ransomware
-
Chinese Hackers Exploit Software Vulnerabilities to Breach Targeted Systems
Tags: breach, china, cyber, exploit, flaw, hacker, network, regulation, software, technology, vulnerabilityChina’s Cyberspace Administration, Ministry of Public Security, and Ministry of Industry and Information Technology introduced the Regulations on the Management of Network Product Security Vulnerabilities (RMSV) in July 2021, mandating that software vulnerabilities exploitable flaws in code be reported to the MIIT within 48 hours of discovery. This policy prohibits researchers from publishing vulnerability details,…
-
UNC3886 Hackers Target Singapore’s Critical Infrastructure by Exploiting 0-Day Vulnerabilities
Tags: china, cyber, cyberattack, exploit, finance, government, group, hacker, infrastructure, mandiant, service, threat, vulnerability, zero-daySingapore’s critical infrastructure sectors, including energy, water, telecommunications, finance, and government services, are facing an active cyberattack from UNC3886, a sophisticated China-linked advanced persistent threat (APT) group renowned for leveraging zero-day exploits and custom malware. First identified by Mandiant in 2022, UNC3886 has been operational since at least 2021, with confirmed activities exploiting vulnerabilities in…