Tag: china
-
Industrial Organizations Under Siege: Chinese Hackers Wield Advanced FatalRAT Malware
A recent investigation by Kaspersky ICS CERT has uncovered a sophisticated cyberattack targeting industrial organizations across the Asia-Pacific region, particularly those in Taiwan, Malaysia, China, Japan, Thailand, South Korea, Singapore, the Philippines, Vietnam, and Hong Kong. The attackers are using a highly advanced version of the FatalRAT malware, delivered through a complex multi-stage payload framework…
-
OpenAI Bans ChatGPT Accounts Used by Chinese Group for Spy Tools
OpenAI has banned ChatGPT accounts used by Chinese threat actors, including ones leveraged for the development of spying tools. The post OpenAI Bans ChatGPT Accounts Used by Chinese Group for Spy Tools appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/openai-bans-chatgpt-accounts-used-by-chinese-group-for-spy-tools/
-
Talos: No Cisco Zero Days Used in Salt Typhoon Telecom Hacks
Tags: breach, china, cisco, credentials, cyberespionage, hacker, login, threat, vulnerability, zero-dayChinese Nation-State Hackers Used a Custom Utility to Capture Packets. Chinese hackers who infiltrated U.S. telecoms likely only used one, known Cisco vulnerability, says Cisco’s threat analysis unit. Otherwise, the Chinese nation-state cyberespionage operation known as Salt Typhoon used stolen login credentials living-off-the-land techniques, says Cisco Talos. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/talos-no-cisco-zero-days-used-in-salt-typhoon-telecom-hacks-a-27576
-
A data leak exposes the operations of the Chinese private firm TopSec, which provides Censorship-as-a-Service
A leak suggests that Chinese cybersecurity firm TopSec offers censorship-as-a-service services, it provided bespoke monitoring services to a state-owned enterprise facing a corruption scandal. SentinelLABS researchers analyzed a data leak that suggests that the Chinese cybersecurity firm TopSec offers censorship-as-a-service services. The origin of the data leak is unclear, the leak is large and inconsistently…
-
OpenAI Bans Accounts Misusing ChatGPT for Surveillance and Influence Campaigns
OpenAI on Friday revealed that it banned a set of accounts that used its ChatGPT tool to develop a suspected artificial intelligence (AI)-powered surveillance tool.The social media listening tool is said to likely originate from China and is powered by one of Meta’s Llama models, with the accounts in question using the AI company’s models…
-
Cisco Confirms Salt Typhoon Exploitation in Telecom Hits
In addition to using CVE-2018-0171 and other Cisco bugs to break into telecom networks, the China-sponsored APT is also using stolen login credentials for initial access. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/cisco-salt-typhoon-exploitation-telecom
-
FBI and CISA warn about continuing attacks by Chinese ransomware group Ghost
Attacks are more focused on encryption than exfiltration: The Ghost attackers have sometimes exfiltrated data back to their Cobalt Strike Team servers or to the Mega.nz file-sharing service, but this has been rare and the amount of information stolen has been limited.According to FBI investigations, the group doesn’t regularly exfiltrate intellectual property or personally identifiable…
-
Leaked Files Tie Chinese Cybersecurity Firm to Government Censorship
TopSec data leak: 7000+ documents expose potential Chinese government surveillance and censorship practices. Learn about the key findings… First seen on hackread.com Jump to article: hackread.com/leaked-files-chinese-cybersecurity-firm-govt-censorship/
-
Talos: No Cisco Zero Days Used in Salt Typhon Telecom Hacks
Tags: breach, china, cisco, credentials, cyberespionage, cybersecurity, hacker, login, vulnerability, zero-dayChinese Nation-State Hackers Used a Custom Utility to Capture Packets. Chinese hackers who infiltrated U.S. telecoms likely only used one, known Cisco vulnerability, says Cisco’s cybersecurity unit. Otherwise, the Chinese nation-state cyberespionage operation known as Salt Typhoon used stolen login credentials living-off-the-land techniques, says Cisco Talos. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/talos-no-cisco-zero-days-used-in-salt-typhon-telecom-hacks-a-27576
-
Cases of China-Backed Spy Groups Using Ransomware Come to Light
Cyberattacks detected by Trend Micro and Orange Cyberdefense find hackers using malware linked to China-backed groups and ransomware, adding more evidence that nation-state cyberespionage groups are also now using ransomware and further blurring the line between the two. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/cases-of-china-backed-spy-groups-using-ransomware-come-to-light/
-
NSA Allegedly Hacked Northwestern Polytechnical University, China Claims
Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a cyberattack on Northwestern Polytechnical University, a prominent Chinese institution specializing in aerospace and defense research. The allegations, published by organizations such as Qihoo 360 and the National Computer Virus Emergency Response Center (CVERC), claim that the NSA’s Tailored Access Operations (TAO)…
-
Data Leak Exposes TopSec’s Role in China’s Censorship-as-a-Service Operations
An analysis of a data leak from a Chinese cybersecurity company TopSec has revealed that it likely offers censorship-as-a-service solutions to prospective customers, including a state-owned enterprise in the country.Founded in 1995, TopSec ostensibly offers services such as Endpoint Detection and Response (EDR) and vulnerability scanning. But it’s also providing “boutique” solutions in order First…
-
Salt Typhoon used new custom malware in telecom attacks
The China-backed hackers used compromised credentials to gain initial access to Cisco devices. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/cisco-salt-typhoon-used-new-custom-malware-in-telecom-attacks/740629/
-
Cisco Details ‘Salt Typhoon’ Network Hopping, Credential Theft Tactics
Cisco Talos observed Chinese hackers pivoting from a compromised device operated by one telecom to target a device in another telecom. The post Cisco Details ‘Salt Typhoon’ Network Hopping, Credential Theft Tactics appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cisco-details-salt-typhoon-network-hopping-credential-theft-tactics/
-
Salt Typhoon Exploited Cisco Devices With Custom Tool to Spy on US Telcos
Chinese threat actor Salt Typhoon used JumbledPath, a custom-built utility, to gain access to a remote Cisco device, said the network provider First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/salt-typhoon-cisco-custom-tool/
-
The US Is Considering a TP-Link Router Ban”, Should You Worry?
Several government departments are investigating TP-Link routers over Chinese cyberattack fears, but the company denies links. First seen on wired.com Jump to article: www.wired.com/story/tp-link-router-ban-investigation/
-
How China Pinned University Cyberattacks on NSA Hackers
A researcher dives into Chinese reports attributing cyberattacks on Northwestern Polytechnical University to the NSA’s TAO division. The post How China Pinned University Cyberattacks on NSA Hackers appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/how-china-pinned-university-cyberattacks-on-nsa-hackers/
-
Ghost Ransomware Targets Orgs in 70+ Countries
The China-backed threat group often acts swiftly, going from initial access to compromise in just one day, a behavior atypical of cybercriminal groups. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/ghost-ransomware-targets-orgs-70-countries
-
CISA, FBI warn of Ghost/Cring ransomware attacks
Ghost is a China-based financially motivated ransomware group that has launched attacks against organizations in more than 70 countries — including its own. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366619496/CISA-FBI-warn-of-Ghost-Cring-ransomware-attacks
-
CISA and FBI Warn of Global Threat from Ghost Ransomware
CISA and the FBI have released a joint advisory detailing the activity of China’s Ghost ransomware First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/cisa-fbi-warn-global-threat-ghost/
-
South Korea Keeps DeepSeek AI Chatbot Off App Stores
Regulators Cite Privacy Concerns Over DeepSeek’s Data Collection Practices. The Personal Information Protection Commission, South Korea’s data protection regulator, has directed Chinese artificial intelligence company DeepSeek AI to withdraw its chatbot application from official app stores pending an inquiry into the chatbot’s compliance with data protection rules. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/south-korea-keeps-deepseek-ai-chatbot-off-app-stores-a-27560
-
Chinese Hackers Exploit Windows Tool to Install Backdoors
Mustang Panda Uses MAVInject to Evade Antivirus Detection. A Chinese state-sponsored hacking group is abusing a legitimate Microsoft tool to evade security and install backdoors on government systems in the Asia-Pacific region. The threat actor uses MAVInject.exe to inject malware into waitfor.exe. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/chinese-hackers-exploit-windows-tool-to-install-backdoors-a-27555
-
Hackers Converting Stolen Payment Card Data into Apple Google Wallets
Cybercriminal groups, primarily based in China, are leveraging advanced phishing techniques and mobile wallet technologies to convert stolen payment card data into fraudulent Apple and Google Wallet accounts. This innovative approach has revitalized the underground carding industry, which had been weakened in recent years by the adoption of chip-based payment cards in the United States.…
-
Malware-Infected Signal, Line, and Gmail Apps Alter System Defenses
A recent cybersecurity analysis has uncovered a campaign targeting Chinese-speaking users through malicious installers of popular applications such as Signal, Line, and Gmail. These backdoored executables exploit manipulated search engine results to lure unsuspecting users into downloading malware-laden files. The attackers employ deceptive tactics, including fake download pages hosted on unrelated domains, to distribute these…
-
New Snake Keylogger Variant Leverages AutoIt Scripting to Evade Detection
A new variant of the Snake Keylogger malware is being used to actively target Windows users located in China, Turkey, Indonesia, Taiwan, and Spain.Fortinet FortiGuard Labs said the new version of the malware has been behind over 280 million blocked infection attempts worldwide since the start of the year.”Typically delivered through phishing emails containing malicious…
-
Mehrheit der Deutschen fürchtet sich vor Cyberangriffen
Viele Deutsche fürchten sich vor gezielten Cyberangriffen, die von Staaten ausgehen.Eine deutliche Mehrheit der Menschen in Deutschland hat Angst vor Cyberangriffen oder gar einem Cyberkrieg. Bei einer repräsentativen Umfrage des Digitalverbandes Bitkom sagten 61 Prozent, dass sie Cyberangriffe durch Staaten befürchten, mit denen Infrastruktur, öffentliche Einrichtungen oder Unternehmen gezielt gestört, sabotiert oder zerstört werden sollen.…
-
China-Linked Threat Group Targets Japanese Orgs’ Servers
Winnti once used a variety of malware but is now focused on SQL vulnerabilities and obfuscation, updated encryption, and new evasion methods to gain access. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/china-linked-threat-group-japanese-orgs-servers
-
Chinese hackers abuse Microsoft APP-v tool to evade antivirus
The Chinese APT hacking group “Mustang Panda” has been spotted abusing the Microsoft Application Virtualization Injector utility as a LOLBIN to inject malicious payloads into legitimate processes to evade detection by antivirus software. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-abuse-microsoft-app-v-tool-to-evade-antivirus/
-
China-linked APT group Winnti targets Japanese organizations since March 2024
China-linked threat actor Winnti targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024 as part of a campaign dubbed RevivalStone. Researchers from cybersecurity firm LAC uncovered a new cyberespionage campaign, tracked as RevivalStone, carried out by the China-linked APT group Winnti in March 2024. Threat actors targeted Japanese companies in the manufacturing,…
-
EagerBee Malware Targets Government Agencies ISPs with Stealthy Backdoor Attack
A sophisticated cyber espionage campaign leveraging the EagerBee malware has been targeting government agencies and Internet Service Providers (ISPs) across the Middle East. This advanced backdoor malware, attributed to the Chinese-linked threat group CoughingDown, demonstrates cutting-edge stealth capabilities and persistence mechanisms, posing a significant threat to critical infrastructure in the region. Advanced Capabilities of EagerBee…