Tag: china
-
Your Network Is Showing Time to Go Stealth
Tags: access, ai, attack, authentication, backdoor, breach, china, cisco, cloud, computer, control, credentials, cyberattack, cybersecurity, data, data-breach, defense, detection, encryption, endpoint, exploit, firewall, firmware, fortinet, group, Hardware, infrastructure, mfa, network, software, theft, threat, tool, update, vpn, vulnerability, zero-day -
Mustang Panda Targets Myanmar With StarProxy, EDR Bypass, and TONESHELL Updates
The China-linked threat actor known as Mustang Panda has been attributed to a cyber attack targeting an unspecified organization in Myanmar with previously unreported tooling, highlighting continued effort by the threat actors to increase the sophistication and effectiveness of their malware.This includes updated versions of a known backdoor called TONESHELL, as well as a new…
-
35 countries use Chinese networks for transporting mobile user traffic, posing cyber risks
An analysis from iVerify found U.S. allies on the list where mobile providers employ China-based networks. First seen on cyberscoop.com Jump to article: cyberscoop.com/35-countries-use-chinese-networks-for-transporting-mobile-user-traffic-posing-cyber-risks/
-
China Plans Expanded Cybersecurity Cooperation with Russia
China has announced a significant step forward in its partnership with Russia, with plans to expand their cooperation in the field of cybersecurity. In an article published by Sputnik News, Chinese Ambassador to Russia Zhang Hanhui outlined Beijing’s intention to deepen its collaboration, emphasizing the shared importance both countries place on digital security and the…
-
Chinese Hacker Group Mustang Panda Bypass EDR Detection With New Hacking Tools
The China-sponsored hacking group, Mustang Panda, has been uncovered by Zscaler ThreatLabz to employ new techniques and tools, including the updated backdoor ToneShell and a novel tool named StarProxy, to evade endpoint detection and response (EDR) systems. Mustang Panda’s New Techniques Mustang Panda, known for targeting government and military entities primarily in East Asia, has…
-
Unmasking the new XorDDoS controller and infrastructure
Cisco Talos observed the ongoing global spread of the XorDDoS malware, predominantly targeting the United States, with evidence suggesting Chinese-speaking operators are using sophisticated tools to orchestrate widespread attacks. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/unmasking-the-new-xorddos-controller-and-infrastructure/
-
Deepfakes haben 2025 Hochkonjunktur sind berühmte Menschen die einzigen Ziele?
Deepfake-Vorfälle entwickeln sich in einem alarmierenden Tempo: Im ersten Quartal 2025 wurden 179 Vorfälle gemeldet ein Anstieg um 19 % gegenüber 2024, wie eine Analyse von Surfshark zeigt [1]. Zu den bemerkenswerten Fakes gehören Taylor Swift in kompromittierenden Situationen, Trump, der die Kleidung von Zelenskyy kritisiert, und Elon Musk, der China-freundliche Ansichten vertritt. Allein… First…
-
China-Linked Hackers Lay Brickstorm Backdoors on Euro Networks
Researchers discovered new variants of the malware, which is tied to a China-nexus threat group, targeting Windows environments of critical infrastructure networks in Europe. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/china-linked-hackers-brickstorm-backdoors-european-networks
-
Chinese hackers set sights on Linux systems, Ivanti appliances
First seen on scworld.com Jump to article: www.scworld.com/brief/chinese-hackers-set-sights-on-linux-systems-ivanti-appliances
-
Chinese Hackers Deploy SNOWLIGHT and VShell in Linux Intrusions
First seen on scworld.com Jump to article: www.scworld.com/brief/chinese-hackers-deploy-snowlight-and-vshell-in-linux-intrusions
-
China’s allegation that NSA hacked Asian Winter Games draws suspicion
Tags: chinaFirst seen on scworld.com Jump to article: www.scworld.com/news/chinas-allegation-that-nsa-hacked-asian-winter-games-draws-suspicion
-
Latest Mustang Panda Arsenal: ToneShell and StarProxy – P1
IntroductionThe Zscaler ThreatLabz team discovered new activity associated with Mustang Panda, originating from two machines from a targeted organization in Myanmar. This research led to the discovery of new ToneShell variants and several previously undocumented tools. Mustang Panda, a China-sponsored espionage group, traditionally targets government-related entities, military entities, minority groups, and non-governmental organizations (NGOs) primarily…
-
CVE program averts swift end after CISA executes 11-month contract extension
Tags: china, cisa, computer, cve, cyber, cybersecurity, data, defense, detection, endpoint, flaw, framework, government, infrastructure, intelligence, linkedin, mitre, nist, nvd, russia, service, software, technology, threat, update, vulnerability, vulnerability-managementImportant update April 16, 2025: Since this story was first published, CISA signed a contract extension that averts a shutdown of the MITRE CVE program.A CISA spokesperson sent CSO a statement saying, “The CVE Program is invaluable to cyber community and a priority of CISA. Last night, CISA executed the option period on the contract to ensure…
-
China-Backed Hackers Exploit BRICKSTORM Backdoor to Spy on European Businesses
NVISO discovered new variants of the BRICKSTORM backdoor, initially designed for Linux, on Windows systems First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-hackers-brickstorm-backdoor/
-
Chinese firm tied to Uyghur rights abuses now training Tibet police on hacking techniques
The digital forensics company known as Meiya Pico won a contract in mid-2023 to build two labs at the Tibet Police College: one on offensive and defensive cyber techniques and the other on electronic evidence collection and analysis. First seen on therecord.media Jump to article: therecord.media/chinese-firm-tied-to-uyghur-abuses-training-police-hacking-tibet
-
Chinese Android phones shipped with malware-laced WhatsApp, Telegram apps
Cheap Chinese Android phones ship with trojanized WhatsApp and Telegram clones hiding crypto clippers, active since June 2024. Since June 2024, Doctor Web researchers found cheap Android phones preloaded with fake WhatsApp and Telegram apps designed to steal crypto via clipping. These clippers swap copied wallet addresses with the attackers’ own. The campaign targeted low-end…
-
Überwachungssoftware infiziert gezielt Smartphones
Fingierte Messenger-Apps täuschen ihre Opfer und führen so freiwillig zur Installation der Schadsoftware.as Bundesamt für Verfassungsschutz und das britische National Cyber Security Centre warnen vor der Gefahr, die von den Schadprogrammen “Moonshine” und “BadBazaar” ausgeht. Dabei handelt es sich um zwei Varianten von Überwachungssoftware, die gezielt Smartphones infizieren, um sensible Daten zu sammeln. Beide werden mit chinesischen…
-
UNC5174 Deploys SNOWLIGHT Malware in Linux and macOS Attacks
A threat group believed to have ties with China’s state-sponsored cyber operations, identified as UNC5174, has launched a stealthy and technically advanced cyber campaign aimed at Linux and macOS environments. According to new research published by Sysdig, the group is… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/unc5174-snowlight-malware-linux-macos/
-
Chinese Hackers Unleash New BRICKSTORM Malware to Target Windows and Linux Systems
A sophisticated cyber espionage campaign leveraging the newly identified BRICKSTORM malware variants has targeted European strategic industries since at least 2022. According to NVISO’s technical analysis, these backdoors previously confined to Linux vCenter servers now infect Windows environments, employing multi-tiered encryption, DNS-over-HTTPS (DoH) obfuscation, and cloud-based Command & Control (C2) infrastructure to evade detection. The…
-
Chinese UNC5174 Group Expands Arsenal with New Open Source Tool and C2 Infrastructure
The Sysdig Threat Research Team (TRT) has revealed a significant evolution in the offensive capabilities of the Chinese state-sponsored threat actor, UNC5174. In late January 2025, after a year of diminished activity, the group launched a new campaign that introduced an open-source tool called VShell, alongside a new command and control (C2) infrastructure. This shift…
-
Chinese Android Phones Shipped with Fake WhatsApp, Telegram Apps Targeting Crypto Users
Cheap Android smartphones manufactured by Chinese companies have been observed pre-installed with trojanized apps masquerading as WhatsApp and Telegram that contain cryptocurrency clipper functionality as part of a campaign since June 2024.While using malware-laced apps to steal financial information is not a new phenomenon, the new findings from Russian antivirus vendor Doctor Web point to…
-
CVE program faces swift end after DHS fails to renew contract, leaving security flaw tracking in limbo
Tags: china, cisa, cve, cyber, cybersecurity, data, detection, endpoint, flaw, government, infrastructure, intelligence, linkedin, mitre, nist, nvd, russia, service, technology, threat, vulnerability, vulnerability-managementMITRE’s CVE program foundational to cybersecurity: MITRE’s CVE program is a foundational pillar of the global cybersecurity ecosystem and is the de facto standard for identifying vulnerabilities and guiding defenders’ vulnerability management programs. It provides foundational data to vendor products across vulnerability management, cyber threat intelligence, security information, event management, and endpoint detection and response.Although…
-
UNC5174: Chinese Threat Actor Deploys New VShell RAT in Campaign
The Sysdig Threat Research Team (TRT) has uncovered a new campaign by the Chinese state-sponsored threat actor UNC5174, First seen on securityonline.info Jump to article: securityonline.info/unc5174-chinese-threat-actor-deploys-new-vshell-rat-in-campaign/
-
BRICKSTORM Backdoor Targets European Industries
In a recent technical expose, NVISO sheds light on BRICKSTORM, a stealthy espionage backdoor attributed to the China-nexus First seen on securityonline.info Jump to article: securityonline.info/brickstorm-backdoor-targets-european-industries/
-
The Salt Typhoon Telecom Breach: When Network Access Becomes National Exposure
The recent Salt Typhoon breach targeting telecom infrastructure isn’t just another headline”, it’s a warning shot to every service provider that uptime and connectivity aren’t enough. This sophisticated campaign, attributed to Chinese state-sponsored actors, illustrates how telecom networks are now being leveraged not just for disruption but for surveillance, espionage, and long-term data access. What…
-
Chinese Hackers Deploy Stealthy Fileless VShell RAT
Malware Hides in Memory, Evades Detection by Endpoint Tools. A Chinese state-backed hacking group tracked as UNC5174 relaunched its operations after a year of silence with a campaign using a memory-only remote access Trojan that evades traditional detection mechanisms, according to new research from cybersecurity firm Sysdig. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-hackers-deploy-stealthy-fileless-vshell-rat-a-28012
-
European Companies Infected With New Chinese-Nexus Backdoor
Threat Actors Deploy Obfuscation Tactics to Targets Windows Machines. Likely Chinese nation-state hackers are targeting European companies using previously unseen malware backdoor variants with advanced network tunneling and evasion capabilities for data theft. Brussels-based security firm Nviso links the campaign to a threat actor tracked as UNC5221. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/european-companies-infected-new-chinese-nexus-backdoor-a-28009
-
China accuses NSA of launching cyberattacks on Asian Winter Games
China on Tuesday accused three alleged employees of the U.S. National Security Agency of carrying out cyberattacks on the Asian Winter Games in February. First seen on therecord.media Jump to article: therecord.media/china-accuses-nsa-hack-asian-winter-games
-
Chinese law enforcement places NSA operatives on wanted list over alleged cyberattacks
The allegations, supported by the foreign ministry, are more specific and aggressive than usual and say the U.S. sought to disrupt the Asian Winter Games. First seen on cyberscoop.com Jump to article: cyberscoop.com/chinese-law-enforcement-places-nsa-operatives-on-wanted-list-over-alleged-cyberattacks/
-
China names alleged US snoops over Asian Winter Games attacks
Beijing claims NSA went for gold in offensive cyber, got caught in the act First seen on theregister.com Jump to article: www.theregister.com/2025/04/15/china_nsa_winter_games/