Tag: china
-
China-linked UnsolicitedBooker APT used new backdoor MarsSnake in recent attacks
China-linked UnsolicitedBooker used a new backdoor, MarsSnake, to target an international organization in Saudi Arabia. ESET researchers revealed that a China-linked APT, tracked as UnsolicitedBooker, targeted an international organization in Saudi Arabia using a new backdoor called MarsSnake. The experts uncovered the attacks in March 2023 and again in 2024, noting that the group used…
-
‘Whatever we did was not enough’: How Salt Typhoon slipped through the government’s blind spots
Seven sources tell CyberScoop that a lack of coordination and miscommunication between federal agencies and the telecommunications industry left critical networks exposed to the Chinese hacking group. First seen on cyberscoop.com Jump to article: cyberscoop.com/salt-typhoon-us-government-response/
-
Chinese Hackers Deploy MarsSnake Backdoor in Multi-Year Attack on Saudi Organization
Tags: attack, backdoor, china, data-breach, email, group, hacker, hacking, international, phishing, spear-phishing, tactics, threatThreat hunters have exposed the tactics of a China-aligned threat actor called UnsolicitedBooker that targeted an unnamed international organization in Saudi Arabia with a previously undocumented backdoor dubbed MarsSnake.ESET, which first discovered the hacking group’s intrusions targeting the entity in March 2023 and again a year later, said the activity leverages spear-phishing emails using First…
-
Blackout: Wie gefährlich sind chinesische Wechselrichter?
US-Behörden haben angeblich versteckte Kommunikationsmodule in Wechselrichtern aus China entdeckt. Die europäische Solarwirtschaft und das BSI zeigen sich ebenfalls besorgt. First seen on golem.de Jump to article: www.golem.de/news/blackout-wie-gefaehrlich-sind-chinesische-wechselrichter-2505-196331.html
-
Chinese cyber spooks lure laid-off US government workers
A Washington DC-based think tank has published evidence that Chinese intelligence services have been running a network of digital ‘front’ companies targeting laid-off government workers as recruits First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366624172/Chinese-cyber-spooks-lure-laid-off-US-government-workers
-
Chinese APT Hackers Target Organizations Using Korplug Loaders and Malicious USB Drives
Advanced persistent threat (APT) groups with ties to China have become persistent players in the cyber espionage landscape, with a special emphasis on European governmental and industrial entities, according to a thorough disclosure from ESET’s APT Activity Report for Q4 2024 to Q1 2025. The report, covering activities from October 2024 to March 2025, highlights…
-
Experts found rogue devices, including hidden cellular radios, in Chinese-made power inverters used worldwide
Tags: chinaChinese >>kill switches>kill switches
-
Former U.S. Govt Employees Targeted by Chinese Intelligence
Report Uncovered Malicious Fake Job Network Operated by a Chinese Company. Recently laid off U.S. federal government officials are being targeted by Chinese intelligence through a network of front companies purporting to offer consulting work. Reports that foreign adversaries intended to recruit former officials began as soon as the administration intentions became apparent. First seen…
-
New botnet HTTPBot targets gaming and tech industries with surgical attacks
New botnet HTTPBot is targeting China’s gaming, tech, and education sectors, cybersecurity researchers warn. NSFOCUS cybersecurity discovered a new botnet called HTTPBot that has been used to target the gaming industry, technology firms, and educational institutions in China. HTTPBot is a Go-based botnet first detected in August 2024, however, its activity surged by April 2025. The botnet…
-
Chinese Agent Impersonate as Stanford Student For Intelligence Gathering
Chinese intelligence operative posing as a Stanford University student has been uncovered following an investigation into suspicious approaches made to students conducting China-related research. The agent, using the alias >>Charles Chen,
-
Umgehen von Firewalls möglich – Versteckte Kommunikationsmodule in Solarwechselrichtern aus China
First seen on security-insider.de Jump to article: www.security-insider.de/us-sicherheitsbedenken-chinesische-solarwechselrichter-a-08272a63260dfa57ee2c903fd338b4f9/
-
Data breach compromises Dior’s Chinese, Korean clients
First seen on scworld.com Jump to article: www.scworld.com/brief/data-breach-compromises-diors-chinese-korean-clients
-
Ban sales of gear from China’s TP-Link, Republican lawmakers tell Trump administration
Senate Intelligence Committee Chairman Tom Cotton and 16 other GOP lawmakers wrote this week to Commerce Secretary Howard Lutnick, saying his department should block future sales of TP-Link’s popular small office/home office (SOHO) internet routers. First seen on therecord.media Jump to article: therecord.media/republican-lawmakers-call-for-tp-link-ban
-
GOP lawmakers urge ban of networking vendor TP-Link, citing ties to China
The Trump administration is facing mounting pressure to formulate a strategy for addressing supply-chain threats that endanger national security. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/tp-link-china-routers-congress-commerce-ban-letter/748227/
-
SAP NetWeaver Flaw Exploited by Ransomware Groups and Chinese-Backed Hackers
The critical vulnerability is being exploited by BianLian, RansomwEXX and a Chinese nation-state actor known as Chaya_004 First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/sap-netweaver-vulnerability/
-
U.S. Officials Probe Rogue Communication Devices in Solar Power Inverters
U.S. energy officials are intensifying scrutiny of Chinese-manufactured power inverters, critical components in renewable energy systems, after discovering undocumented communication equipment embedded within them. These inverters, predominantly produced in China, are essential for connecting solar panels, wind turbines, batteries, heat pumps, and electric vehicle chargers to electricity grids worldwide. The presence of rogue cellular radios…
-
An $8.4 billion money launderer has been operating for years on US soil
Tags: chinaBefore crackdown, this was one of the ‘Net’s biggest markets for Chinese-speaking scammers. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/05/incorporated-in-us-8-4b-money-launderer-for-chinese-speaking-crypto-scammers/
-
Xinbi Telegram Market Tied to $8.4B in Crypto Crime, Romance Scams, North Korea Laundering
Tags: blockchain, china, crime, crypto, data, data-breach, korea, marketplace, north-korea, scam, technologyA Chinese-language, Telegram-based marketplace called Xinbi Guarantee has facilitated no less than $8.4 billion in transactions since 2022, making it the second major black market to be exposed after HuiOne Guarantee.According to a report published by blockchain analytics firm Elliptic, merchants on the marketplace have been found to peddle technology, personal data, and money laundering…
-
Chinese Hackers Exploit SAP NetWeaver Zero-Day Vulnerability to Target Critical Infrastructure
Tags: china, cve, cyber, espionage, exploit, flaw, hacker, infrastructure, remote-code-execution, sap, threat, vulnerability, zero-dayEclecticIQ analysts have uncovered a sophisticated cyber-espionage campaign orchestrated by China-nexus nation-state Advanced Persistent Threats (APTs) targeting critical infrastructure worldwide. In April 2025, these threat actors launched a high-tempo exploitation campaign against SAP NetWeaver Visual Composer, exploiting a zero-day vulnerability identified as CVE-2025-31324. This unauthenticated file upload flaw allows remote code execution (RCE), providing attackers…
-
Earth Ammit Hackers Deploy New Tools to Target Military Drones
The threat actor group known as Earth Ammit, believed to be associated with Chinese-speaking APTs, has emerged as a significant concern for military and industrial sectors in Eastern Asia. This group orchestrated two distinct campaigns-VENOM and TIDRONE-primarily targeting Taiwan and South Korea. Their focus on supply chain infiltration, particularly within the drone and military industries,…
-
Chinese Actor Hit Taiwanese Drone Makers, Supply Chains
Tidrone concentrated on military entities and the satellite sector, using their associated service providers and ERP software to infect not just drones but all the entities that are part of their supply chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/chinese-actor-taiwanese-drone-makers-supply-chains
-
China helps North Korean operatives land IT roles, bypassing sanctions
One Chinese company with at least 35 affiliates has shipped IT equipment to a North Korean government-backed organization. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/north-korea-it-worker-scam-china-research/748009/
-
Chinese-speaking hackers disrupt drone supply chains in Taiwan, researchers say
Earth Ammit, as the group is known, launched two waves of campaigns from 2023 to 2024, affecting a range of industries including military, satellite, heavy industry, media, technology, software services and healthcare. First seen on therecord.media Jump to article: therecord.media/chinese-hackers-target-taiwan-military-sector
-
Chinese-speaking hackers disrupt drone supply chains in Taiwan, researchers say
Earth Ammit, as the group is known, launched two waves of campaigns from 2023 to 2024, affecting a range of industries including military, satellite, heavy industry, media, technology, software services and healthcare. First seen on therecord.media Jump to article: therecord.media/chinese-hackers-target-taiwan-military-sector
-
>>TheWizards<<: China-Hacker kapern Software-Updates
Die Sicherheitsforscher des Antivirenherstellers ESET haben eine groß angelegte Spionagekampagne aufgedeckt, die offenbar von der staatlich unterstützten chinesischen Hackergruppe “TheWizards” durchgeführt wird. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/thewizards-china-hacker-updates
-
China-Linked APTs Exploit SAP CVE-2025-31324 to Breach 581 Critical Systems Worldwide
Tags: apt, breach, china, cve, exploit, flaw, infrastructure, remote-code-execution, sap, vulnerabilityA recently disclosed critical security flaw impacting SAP NetWeaver is being exploited by multiple China-nexus nation-state actors to target critical infrastructure networks.”Actors leveraged CVE-2025-31324, an unauthenticated file upload vulnerability that enables remote code execution (RCE),” EclecticIQ researcher Arda Büyükkaya said in an analysis published today.Targets of the campaign First seen on thehackernews.com Jump to article:…
-
China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures
Tags: access, api, apt, attack, authentication, backdoor, backup, breach, business, china, cloud, control, cve, cyber, data, data-breach, detection, dns, encryption, endpoint, espionage, exploit, finance, firewall, fortinet, google, government, group, infection, infrastructure, intelligence, Internet, ivanti, linux, malicious, malware, mandiant, military, network, open-source, programming, rat, remote-code-execution, reverse-engineering, risk, rust, sap, service, strategy, tactics, threat, tool, update, vmware, vpn, vulnerability, windows, zero-dayExecutive Summary EclecticIQ analysts assess with high confidence that, in April 2025, China-nexus nation-state APTs (advanced persistent threat) launched high-temp exploitation campaigns against critical infrastructure networks by targeting SAP NetWeaver Visual Composer. Actors leveraged CVE-2025-31324 [1], an unauthenticated file upload vulnerability that enables remote code execution (RCE). This assessment is based on a publicly…
-
An $8.4 Billion Chinese Hub for Crypto Crime Is Incorporated in Colorado
Before a crackdown by Telegram, Xinbi Guarantee grew into one of the internet’s biggest markets for Chinese-speaking crypto scammers and money laundering. And all registered to a US address. First seen on wired.com Jump to article: www.wired.com/story/xinbi-guarantee-crypto-scam-hub/
-
States push WeChat for answers over money laundering allegations
According to a letter sent to the company on Monday, Chinese underground banking networks use WeChat to “orchestrate cash pickups in U.S. cities, arrange currency swaps between fentanyl traffickers and Chinese money brokers,” and more. First seen on therecord.media Jump to article: therecord.media/states-push-wechat-for-money-laundering-answers
-
Can Cybersecurity Keep Up In the AI Arms Race?
New research shows China is quickly catching up with the US in AI innovation. Experts weigh in on what it means for cyber defenders. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/can-cybersecurity-keep-up-ai-arms-race