Tag: china
-
Chinese Hackers Accelerate Cyberattacks Using Low-Cost AI Tools: Research
Tags: ai, china, cyber, cyberattack, cybersecurity, group, hacker, intelligence, network, open-source, toolState-affiliated Chinese hackers are dramatically scaling up foreign cyberattacks by integrating open-source artificial intelligence (AI) models into their operations, according to new research from cybersecurity firms TeamT5 and Palo Alto Networks Inc.’s Unit 42. By offloading mundane tasks and automated target-mapping to cheap, accessible AI tools, state-backed cyber groups have more than doubled their attack..…
-
Mysterious Ox Alpha Stealth AI Model Emerges for Coding and Agentic Work
A newly discovered AI system called Ox Alpha has emerged on OpenRouter, sparking widespread speculation within the AI community regarding its origin, technical capabilities, and potential connections to major Chinese or Western model developers. Released on Thursday as a free preview model, Ox Alpha is described on OpenRouter as “a reasoning model designed for coding,…
-
Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent.The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate…
-
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
Cybersecurity researchers have disclosed details of a Chinese-speaking cybercrime group dubbed UAT-10147 that’s targeting Windows and Linux web servers globally across the education, media, technology, and gaming sectors.The vast majority of the targets are located in Brazil, Bolivia, China, Canada, and Vietnam. Details of the threat activity came to light following the discovery of an…
-
Cybersecurity Newsletter Bulletin Top 50 Biggest Cybersecurity Stories of the Week Shell Azure Mega-Breaches, Salt Typhoon Evicted, Entra ID RCE, Chinese vCenter ESXi Ransomware More
Tags: breach, china, cisa, credentials, cyber, cybersecurity, exploit, flaw, mobile, ransomware, rce, remote-code-execution, theft, vcenterWelcome to this week’s edition of the GBHackers cybersecurity newsletter, your weekly cybersecurity bulletin covering the 50 most important stories from August 1721, 2026. Breaches and exploited flaws dominated: Cl0p claimed 89GB from Shell, a mass Azure credential-theft campaign hit McDonald’s and Vodafone, and T-Mobile physically cut a cable to evict Salt Typhoon. CISA […]…
-
Chinese Hacker Uses DeepSeek and Hermes Agent to Launch Autonomous Cyberattacks
A Chinese-speaking threat actor has been observed using DeepSeek through the Hermes Agent framework to automate reconnaissance, vulnerability research, exploit acquisition, and attack attempts against internet-facing infrastructure. According to Unit 42, the actor tracked under the aliases knaithe and KnYuan built an AI-assisted offensive environment that combined DeepSeek’s reasoning capabilities with Hermes Agent’s terminal access,…
-
UAT-10147 Compromises Web Servers to Deploy BadIIS for SEO Fraud and Data Theft
Tags: china, cyber, cybercrime, data, data-breach, finance, fraud, government, group, linux, malware, technology, theft, vulnerability, windowsA Chinese-speaking cybercrime group, tracked as UAT-10147, targeting vulnerable Windows and Linux web servers worldwide to deploy BadIIS malware, steal data, and manipulate search engine results for financial gain. Talos observed victims in Brazil, Bolivia, China, Canada, and Vietnam, spanning government, education, media, technology, and gaming organizations. An operational security lapse exposed an attacker download…
-
SilkParasite Uses Google Drive as C2 to Hide RAT Traffic Inside Trusted Cloud Services
SilkParasite, a long-running cyberespionage operation targeting government bodies across Central Asia through a compact but highly mature arsenal of remote access trojans. Assessed with medium confidence as China-nexus activity, the campaign stands out for using Google Drive as a command-and-control channel, allowing malware traffic to blend into cloud activity that many enterprises inherently trust. The…
-
T-Mobile cybersecurity staff cut cable to expel Chinese hackers
First seen on scworld.com Jump to article: www.scworld.com/brief/t-mobile-cybersecurity-staff-cut-cable-to-expel-chinese-hackers
-
China’s ‘SilkParasite’ espionage operation targeting Central Asia with AI-assisted malware
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments. First seen on therecord.media Jump to article: therecord.media/china-cyber-espionage-central-asia
-
China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure”, Is the US Ready?
This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon First seen on wired.com Jump to article: www.wired.com/story/china-is-strapping-digital-bombs-to-civilian-infrastructure-is-the-us-ready/
-
China Is Strapping ‘Digital Bombs’ to Civilian Infrastructure”, Is the US Ready?
This week on “Uncanny Valley,” Andy Greenberg discusses sitting in on a war game simulating a cyberattack from the Chinese hacking group Volt Typhoon First seen on wired.com Jump to article: www.wired.com/story/china-is-strapping-digital-bombs-to-civilian-infrastructure-is-the-us-ready/
-
UAT-10147: Chinese-speaking adversary integrates agentic AI into post-compromise operations
Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-10147-chinese-speaking-adversary-integrates-agentic-ai-into-post-compromise-operations/
-
Spionage aus China: T-Mobile US soll Cyberangriff mit Schere bekämpft haben
Chinesische Hacker hatten sich 2024 tief in die Infrastruktur von US-Providern eingenistet. T-Mobile hat für die Cyberabwehr wohl sogar ein Kabel durchgeschnitten. First seen on golem.de Jump to article: www.golem.de/news/spionage-aus-china-t-mobile-us-soll-cyberangriff-mit-schere-bekaempft-haben-2608-212119.html
-
T-Mobile Physically Cuts Network Cable to Evict Chinese Salt Typhoon Hackers
In 2024, T-Mobile’s security team took an unusually direct approach to contain a cybersecurity threat: they physically cut a network cable to terminate suspected access by the Chinese state-backed hackers known as Salt Typhoon. According to CSN, this action came after months of incident response efforts within T-Mobile’s network, during which defenders investigated signs of…
-
T-Mobile ‘chopped a cable’ to expel Chinese hackers from its network
The U.S. phone provider escaped a large-scale breach of its network after identifying Chinese-backed hackers early on. First seen on techcrunch.com Jump to article: techcrunch.com/2026/08/19/t-mobile-chopped-a-cable-to-expel-chinese-hackers-from-its-network/
-
SilkParasite Threatens Central Asian Orgs With Flurry of RATs
A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into geopolitical, technical, and strategic global moves by China’s APTs. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/silkparasite-central-asian-orgs-flurry-rats
-
SilkParasite: Tracking a China-Nexus APT Across Central Asia
<div cla TL;DR: SilkParasite is a cyberespionage operation, assessed at medium confidence as China-nexus, that targeted government bodies across Central Asia. Bitdefender Labs found seven remote access tool (RAT) families in use, five of which were previously undocumented; we identified and named them: DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, and NodeEdgeRAT. The toolset is small, modular, and…
-
China-Nexus Hackers Target Myanmar Diplomats With QUICAgent Go Backdoor via Malicious VHD Files
A China-nexus threat actor is targeting Myanmar government and diplomatic personnel with a multi-stage malware campaign that delivers a custom Go-based backdoor, dubbed QUICAgent, through Virtual Hard Disk (VHD) files disguised as benign images. The campaign relies on highly targeted social engineering. One malicious file, named TrainingAnnouncement.jpg, is not an image but a VHD container.…
-
China-Linked Hacker Shows AI Capabilities in APAC Attack
In the first purported near-autonomous attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/china-linked-hacker-ai-capabilities-apac-attack
-
China-Linked APT Uses AI to Optimize Hand-Built Malware
SilkParasite Deployed Against Central Asian Governments. Bitdefender said the China-linked SilkParasite espionage campaign deployed seven modular RATs against Central Asian governments, with coding artifacts indicating AI assisted expert developers rather than generating the stealth-focused malware itself. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-apt-uses-ai-to-optimize-hand-built-malware-a-32597
-
Meta’s legal jeopardy is growing by the day
Also: AI’s implications on cybersecurity in an era of private attacksHello, and welcome to TechScape. I’m your host, Blake Montgomery, US tech editor at the Guardian. Today in tech, we’re discussing <a href=”https://www.theguardian.com/technology/meta”>Meta’s legal danger in the US and the implications of <a href=”https://www.theguardian.com/technology/artificialintelligenceai”>artificial intelligence for cybersecurity in an era of private cyberattacks.<a href=”https://www.theguardian.com/us-news/video/2026/aug/11/why-the-us-government-is-trying-to-ban-this-chinese-dancing-robot-video-explainer”>Why the…
-
Chinese AI model GLM-5.3 shows advanced bug-finding capabilities
First seen on scworld.com Jump to article: www.scworld.com/brief/chinese-ai-model-glm-5-3-shows-advanced-bug-finding-capabilities
-
US FCC Weighs Chinese Transceiver Supply-Chain Crackdown
Draft Covered List Expansion Would Reach Components Inside AI Data Center Switches. The U.S. FCC reportedly may restrict imports of new-model optical transceivers made in China, a move that would reach AI data center interconnects for the first time and leaves open how regulators would define origin, what counts as a new model and whether…
-
China-Nexus Threat Actor Targeting Critical VMware Flaw
A China-nexus bad actor is likely behind the rapid exploitation of a critical flaw in VMware’s vCenter management software that has spread across 361 victim IP addresses in almost four dozen countries. Exploitation of the vulnerability tracked as CVE-2026-59310 started five days after VMware owner Broadcom first disclosed the security flaw July 29,.. First seen…
-
China-Linked Hackers Use N-able Flaw in Ransomware Attacks
Microsoft Says Storm-1175 Exploited CVE-2026-18577 After Its Disclosure. Microsoft says China-linked Storm-1175 is exploiting N-able N-central authentication bypass CVE-2026-18577 to gain administrative RMM access, pivot into managed endpoints and rapidly deploy its new StormEncryptor ransomware. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-use-n-able-flaw-in-ransomware-attacks-a-32506
-
China-Linked Hackers Exploit N-able Flaw in Ransomware Attacks
Microsoft Says Storm-1175 Exploited CVE-2026-18577 After Its Disclosure. Microsoft says China-linked Storm-1175 is exploiting N-able N-central authentication bypass CVE-2026-18577 to gain administrative RMM access, pivot into managed endpoints and rapidly deploy its new StormEncryptor ransomware. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-exploit-n-able-flaw-in-ransomware-attacks-a-32506
-
Royal Navy Cuts Camera Internet Access After Drones Contact Chinese IP
Royal Navy drone cameras contacted a Chinese IP address, raising cybersecurity concerns over third-party hardware, supplier vetting, and device traffic. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/cybersecurity/news-navy-drone-camera-china-emea-uk/
-
China-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central Flaw
Microsoft has disclosed that Storm-1175, a financially motivated threat actor linked to China, has deployed a previously undocumented ransomware strain called StormEncryptor.The use of StormEncryptor marks a shift from the adversary’s previous use of Medusa ransomware, the Microsoft Threat Intelligence Team said.”StormEncryptor is written in C++ and appends the file name extension .encrypted First seen…
-
China-linked hackers turning popular cybersecurity tool into ransomware launchpad, Microsoft warns
Tags: china, cybersecurity, exploit, hacker, microsoft, ransomware, software, threat, tool, vulnerabilityA China-linked threat actor is believed to be exploiting a critical vulnerability affecting cybersecurity software from the company N-able. First seen on therecord.media Jump to article: therecord.media/china-hackers-ransomware-microsoft