Tag: china
-
BSI warnt vor Cyberattacken auf Energieversorgung
Die BSI-Präsidentin Claudia Plattner fordert einen besseren IT-Schutz für die Energieversorgung in Deutschland. Die Energieversorgung in Deutschland braucht aus Sicht der Präsidentin des Bundesamtes für Sicherheit in der Informationstechnik (BSI), Claudia Plattner, einen besseren Schutz. Die Behörde sehe hier eine wachsende Angriffsfläche für Cyberkriminelle, sagte Plattner der Funke-Mediengruppe. Derzeit gelte das Stromnetz als sicher und…
-
Decade of Stealth: China-Linked TA-ShadowCricket Targets Asia-Pacific
AhnLab and South Korea’s National Cyber Security Center (NCSC) have released a detailed joint report on a persistent First seen on securityonline.info Jump to article: securityonline.info/decade-of-stealth-china-linked-ta-shadowcricket-targets-asia-pacific/
-
FCC bans US electronics testing in risky Chinese labs
Tags: chinaFirst seen on scworld.com Jump to article: www.scworld.com/brief/fcc-bans-us-electronics-testing-in-risky-chinese-labs
-
Ivanti EPMM flaws leveraged in global Chinese cyberespionage attacks
First seen on scworld.com Jump to article: www.scworld.com/brief/ivanti-epmm-flaws-leveraged-in-global-chinese-cyberespionage-attacks
-
Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability
Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile (EPMM) version 12.5.0.0 and earlier. These flaws, when chained together, allow unauthenticated remote code execution (RCE) on internet-facing systems, posing a severe risk to enterprise security. EclecticIQ analysts have confirmed active exploitation in the wild since the disclosure date, with…
-
Chinese cyber spies are using Ivanti EPMM flaws to breach EU, US organizations
CVE-2025-4427 and CVE-2025-4428 the two Ivanti Endpoint Manager Mobile (EPMM) vulnerabilities that have been exploited in the wild as zero-days and patched by Ivanti … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/05/23/chinese-cyber-spies-are-using-ivanti-epmm-flaws-to-breach-eu-us-organizations/
-
Critical infrastructure under attack: Flaws becoming weapon of choice
Tags: access, attack, authentication, breach, china, citrix, communications, control, cve, cyber, cybersecurity, dark-web, data-breach, defense, exploit, flaw, fortinet, government, group, hacker, healthcare, ibm, identity, incident, infrastructure, intelligence, iran, kev, login, mfa, monitoring, moveIT, network, ransomware, risk, service, software, strategy, supply-chain, threat, update, vpn, vulnerability, zero-dayTrade in exploit code: IBM’s X-Force found four of the 10 most mentioned common vulnerabilities and exposures (CVEs) on the dark web were linked to sophisticated threat actor groups, including nation-state intelligence agencies.”Exploit codes for these CVEs were openly traded on numerous forums, fueling a growing market for attacks against power grids, health networks, and…
-
Chinese threat actors exploited Trimble Cityworks flaw to breach U.S. local government networks
A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy Cobalt Strike and VShell. Cisco Talos researchers attribute the exploitation of the CVE-2025-0994 in Trimble Cityworks to Chinese-speaking threat actor UAT-6382, based on tools and TTPs used in the intrusions. The vulnerability CVE-2025-0994 (CVSS v4 score of 8.6) is a…
-
Ivanti makes dedicated fans of Chinese spies who just can’t resist attacking its buggy kit
If it ain’t broke? First seen on theregister.com Jump to article: www.theregister.com/2025/05/23/ivanti_chinese_spies_attack/
-
Chinese-speaking hackers targeting US municipalities with Cityworks bug
Since January, cybersecurity experts have seen Chinese-speaking hackers exploiting a bug impacting a tool used by local governments to manage critical infrastructure assets and other services. First seen on therecord.media Jump to article: therecord.media/chinese-speaking-hackers-target-municipalities-cityworks
-
Chinese snoops tried to break into US city utilities, says Talos
Tags: chinaIntrusions began weeks before Trimble patched the Cityworks hole First seen on theregister.com Jump to article: www.theregister.com/2025/05/22/chinese_crew_us_city_utilities/
-
Cityworks Zero-Day Vulnerability Used by UAT-638 Hackers to Infect IIS Servers with Shell Malware
Cisco Talos has uncovered active exploitation of a zero-day remote-code-execution vulnerability, identified as CVE-2025-0994, in Cityworks, a widely used asset management system. This critical flaw has been leveraged by a group tracked as UAT-6382, assessed with high confidence to be Chinese-speaking threat actors, to target enterprise networks of local governing bodies in the United States…
-
Researchers Warn of ‘Smiao Network’ Cyber Threat Against Taiwan’s Federal Staff
The Foundation for Defense of Democracies (FDD) and cybersecurity firm TeamT5 has exposed an intricate Chinese intelligence operation, dubbed the ‘Smiao Network,’ targeting federal workers in both the United States and Taiwan. This network, linked to the Chinese technology company Smiao Intelligence, employs deceptive online recruitment schemes to extract sensitive information from high-value professionals. Initially…
-
Chinese Hackers Exploit Trimble Cityworks Flaw to Infiltrate U.S. Government Networks
Tags: access, china, cisco, cve, exploit, flaw, government, hacker, malware, network, remote-code-execution, threat, vulnerabilityA Chinese-speaking threat actor tracked as UAT-6382 has been linked to the exploitation of a now-patched remote-code-execution vulnerability in Trimble Cityworks to deliver Cobalt Strike and VShell.”UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance, and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access,” Cisco Talos researchers First seen on thehackernews.com Jump…
-
Ivanti EPMM flaw exploited by Chinese hackers to breach govt agencies
Tags: breach, china, endpoint, exploit, flaw, government, hacker, ivanti, mobile, remote-code-executionChinese hackers have been exploiting a remote code execution flaw in Ivanti Endpoint Manager Mobile (EPMM) to breach high-profile organizations worldwide. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ivanti-epmm-flaw-exploited-by-chinese-hackers-to-breach-govt-agencies/
-
Chinese hackers breach US local governments using Cityworks zero-day
Chinese-speaking hackers have exploited a now-patched Trimble Cityworks zero-day to breach multiple local governing bodies across the United States. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-breach-us-local-governments-using-cityworks-zero-day/
-
Chinese Hackers Exploit Ivanti EPMM Bugs in Global Enterprise Network Attacks
A recently patched pair of security flaws affecting Ivanti Endpoint Manager Mobile (EPMM) software has been exploited by a China-nexus threat actor to target a wide range of sectors across Europe, North America, and the Asia-Pacific region.The vulnerabilities, tracked as CVE-2025-4427 (CVSS score: 5.3) and CVE-2025-4428 (CVSS score: 7.2), could be chained to execute arbitrary…
-
Critical 0-Day: Cityworks Flaw Actively Exploited by Chinese APT UAT-6382
A newly identified Chinese-speaking threat actor cluster, tracked as UAT-6382, is actively exploiting a zero-day vulnerability in Cityworks First seen on securityonline.info Jump to article: securityonline.info/critical-0-day-cityworks-flaw-actively-exploited-by-chinese-apt-uat-6382/
-
UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware
Talos has observed exploitation of CVE-2025-0994 in the wild by UAT-6382, a Chinese-speaking threat actor, who then deployed malware payloads via TetraLoader. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/
-
Pandas Galore: Chinese Hackers Boost Attacks in Latin America
Vixen Panda, Aquatic Panda, both Beijing-sponsored APTs and financially motivated criminal groups continued to pose the biggest threat to organizations in Central and South America last year, says CrowdStrike. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/pandas-galore-chinese-hackers-attacks-latin-america
-
China-linked operative exposed at U.S. university
First seen on scworld.com Jump to article: www.scworld.com/brief/china-linked-operative-exposed-at-u-s-university
-
Novel MarsSnake backdoor spread in Chinese APT attack
First seen on scworld.com Jump to article: www.scworld.com/brief/novel-marssnake-backdoor-spread-in-chinese-apt-attack
-
Mass federal worker layoffs exploited by Chinese cyberespionage campaign
First seen on scworld.com Jump to article: www.scworld.com/brief/mass-federal-worker-layoffs-exploited-by-chinese-cyberespionage-campaign
-
Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security
A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party JavaScript to deliver a Chinese adult-content Progressive Web App (PWA) scam. This attack, which redirects users to sites like hxxps://xjdm166[.]com, leverages the unique capabilities of PWAs to retain users longer and evade traditional browser security mechanisms. Unlike typical phishing attempts, this…
-
16 Städte vernetzt: China Telecom baut größtes Quantenkommunikationsnetz
Tags: chinaMit Quantenkryptografie und -schlüsselaustausch: 16 vernetzte Städte sollen das größte Netz für Quantenkommunikation bilden. First seen on golem.de Jump to article: www.golem.de/news/16-staedte-vernetzt-china-telecom-baut-groesstes-quantenkommunikationsnetz-2505-196421.html
-
Researchers Expose PWA JavaScript Attack That Redirects Users to Adult Scam Apps
Cybersecurity researchers have discovered a new campaign that employs malicious JavaScript injections to redirect site visitors on mobile devices to a Chinese adult-content Progressive Web App (PWA) scam.”While the payload itself is nothing new (yet another adult gambling scam), the delivery method stands out,” c/side researcher Himanshu Anand said in a Tuesday analysis.”The malicious landing…
-
Asia Produces More APT Actors, As Focus Expands Globally
China and North Korea-aligned groups account for more than half of global attacks, and an increasing number of countries look to cyber to balance power in the region. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/asia-apt-actors-focus-expands-globally
-
Europe subjected to mounting Chinese APT intrusions
First seen on scworld.com Jump to article: www.scworld.com/brief/europe-subjected-to-mounting-chinese-apt-intrusions
-
Researchers warn of China-backed espionage campaign targeting laid-off US workers
A report by FDD says an elaborate online recruiting effort is using LinkedIn and fake online companies to gather sensitive intelligence. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-espionage-campaign-laid-off-workers/748607/
-
China-linked UnsolicitedBooker APT used new backdoor MarsSnake in recent attacks
China-linked UnsolicitedBooker used a new backdoor, MarsSnake, to target an international organization in Saudi Arabia. ESET researchers revealed that a China-linked APT, tracked as UnsolicitedBooker, targeted an international organization in Saudi Arabia using a new backdoor called MarsSnake. The experts uncovered the attacks in March 2023 and again in 2024, noting that the group used…