Tag: china
-
Chinese Hackers Exploit MAVInject.exe to Evade Detection in Targeted Cyber Attacks
The Chinese state-sponsored threat actor known as Mustang Panda has been observed employing a novel technique to evade detection and maintain control over infected systems.This involves the use of a legitimate Microsoft Windows utility called Microsoft Application Virtualization Injector (MAVInject.exe) to inject the threat actor’s malicious payload into an external process, waitfor.exe, First seen on…
-
Mustang Panda Leverages Microsoft Tools to Bypass Anti-Virus Solutions
Trend Micro found that Chinese espionage group Mustang Panda is deploying malware via legitimate Microsoft tools, enabling it to bypass ESET antivirus applications First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/mustang-panda-microsoft-bypass/
-
Winnti APT41 Targets Japanese Firms in RevivalStone Cyber Espionage Campaign
The China-linked threat actor known as Winnti has been attributed to a new campaign dubbed RevivalStone that targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024.The activity, detailed by Japanese cybersecurity company LAC, overlaps with a threat cluster tracked by Trend Micro as Earth Freybug, which has been assessed to be…
-
Chinese Hackers Emperor Dragonfly Use Espionage Tools for Ransomware
Cybersecurity experts at Symantec report that the Chinese threat actor Emperor Dragonfly has employed tools previously associated with First seen on securityonline.info Jump to article: securityonline.info/chinese-hackers-emperor-dragonfly-use-espionage-tools-for-ransomware/
-
Nico Lange: ‘Cybersicherheit ist eine Frage der Verteidigung”
Tags: ai, china, conference, cyberattack, cybercrime, cyersecurity, germany, governance, government, infrastructure, iran, north-korea, risk, ukraine, usaMunich Security Conference Live Studio powered by APCO in Munich, Germany on February 15, 2025. (Photo by Christopher Pike / christopherpike.com) APCO.Welches sind laut dem Münchner Sicherheitsindex die größten Risiken für Europa im Jahr 2025?Nun, ich denke, das größte Risiko besteht in der sogenannten Multipolarisierung. Europa wird Schwierigkeiten haben, sein Geschäftsmodell fortzuführen, das auf den…
-
A PostgreSQL zero-day was also exploited in US Treasury hack (CVE-2025-1094)
The suspected Chinese state-sponsored hackers who breached workstations of several US Treasury employees in December 2024 did so by leveraging not one, but two zero-days, … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/17/a-postgresql-zero-day-was-also-exploited-in-us-treasury-hack-cve-2025-1094/
-
South Korea Suspends DeepSeek AI Downloads Over Privacy Violations
South Korea has formally suspended new downloads of Chinese artificial intelligence (AI) chatbot DeepSeek in the country until the service makes changes to its mobile apps to comply with data protection regulations.Downloads have been paused as of February 15, 2025, 6:00 p.m. local time, the Personal Information Protection Commission (PIPC) said in a statement. The…
-
Die Angst vor Cyberangriffen und einem Cyberkrieg
7 von 10 sehen große Gefahr durch Cybercrime für Deutschland, 6 von 10 fürchten einen Cyberkrieg. Als größte Cyberbedrohung gelten Russland und China aber ein Drittel sieht auch die USA als Gefahr. Bitkom legt Cyberbilanz der Nationalen Sicherheitsstrategie anlässlich der Munich Cyber Security Conference vor. In Deutschland greift die Angst vor Cyberangriffen… First seen on…
-
Salt Typhoon Exploits Cisco Devices in Telco Infrastructure
The China-sponsored state espionage group has exploited known, older bugs in Cisco gear for successful cyber intrusions on six continents in the past two months. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/salt-typhoon-exploits-cisco-devices-telco-infrastructure
-
RA World Ransomware Intrusion Involved Chinese Cyberespionage Tools
First seen on scworld.com Jump to article: www.scworld.com/brief/ra-world-ransomware-intrusion-involved-chinese-cyberespionage-tools
-
China’s RedMike hackers taking aim at telcos via flaws in Cisco gear
First seen on scworld.com Jump to article: www.scworld.com/news/chinas-redmike-hackers-taking-aim-at-telcos-via-flaws-in-cisco-gear
-
China-linked APT Salt Typhoon breached telecoms by exploiting Cisco router flaws
China-linked APT Salt Typhoon has breached more U.S. telecommunications providers via unpatched Cisco IOS XE network devices. China-linked APT group Salt Typhoon is still targeting telecommunications providers worldwide, and according to a new report published by Recorded Future’s Insikt Group, the threat actors has breached more U.S. telecommunications providers by exploiting unpatched Cisco IOS XE…
-
AI Action Summit and Regulatory Concerns That Won’t Go Away
Forrester’s Thomas Husson on Reactions to DeepSeek, Fears of Overregulation. The AI Action Summit this week came on the heels of the DeepSeek-R1 launch by Chinese AI company, as well as recent enforcement actions of the EU AI Act. A number of leaders from both inside and outside of Europe criticized the EU law, fearing…
-
Chinese Cyber-Spies Use Espionage Tools for Ransomware Side Hustle
A Chinese threat actor who targeted an Asian software company used the same toolset for the ransomware attack that was found in multiple cyberespionage incidents, leaving Symantec analysts to believe the hacker was a Chinese spy who used the malicious tools to earn some money on the side. First seen on securityboulevard.com Jump to article:…
-
Chinese hackers breach more US telecoms via unpatched Cisco routers
China’s Salt Typhoon hackers are still actively targeting telecoms worldwide and have breached more U.S. telecommunications providers via unpatched Cisco IOS XE network devices. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-hackers-breach-more-us-telecoms-via-unpatched-cisco-routers/
-
Salt Typhoon Targeting Old Cisco Vulnerabilities in Fresh Telecom Hacks
China-linked APT Salt Typhoon has been exploiting known vulnerabilities in Cisco devices in attacks on telecom providers in the US and abroad. The post Salt Typhoon Targeting Old Cisco Vulnerabilities in Fresh Telecom Hacks appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/salt-typhoon-targeting-old-cisco-vulnerabilities-in-fresh-telecom-hacks/
-
New Windows Zero-Day Exploited by Chinese APT: Security Firm
ClearSky Cyber Security says it has seen a new Windows zero-day being exploited by a Chinese APT named Mustang Panda. The post New Windows Zero-Day Exploited by Chinese APT: Security Firm appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/new-windows-zero-day-exploited-by-chinese-apt-security-firm/
-
China-Linked Espionage Tools Used in Recent Ransomware Attack
Symantec found that tools previously only used by Chinese nation-state espionage actors were deployed in a ransomware attack First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/chinese-espionage-tools-ransomware/
-
Chinese spies suspected of ‘moonlighting’ as tawdry ransomware crooks
Some employees steal sticky notes, others ‘borrow’ malicious code First seen on theregister.com Jump to article: www.theregister.com/2025/02/14/chinese_spies_ransomware_moonlighting/
-
In Paris, U.S. signals shift from AI safety to deregulation
The Trump administration made it clear that innovation and competition with China would be bigger priorities. First seen on cyberscoop.com Jump to article: cyberscoop.com/ai-safety-jd-vance-paris-ai-summit-deregulation/
-
APT Groups Using Ransomware ‘Smokescreen’ for Espionage
Russian, Iranian and Chinese APTs Among Most Active Ransomware Collaborators. Security researchers are increasingly finding it challenging to attribute cyberattacks due to surging cooperation between nation-state hackers and ransomware groups, especially for espionage purposes. They say it reflects the blurring of the lines between state-directed and criminal activities. First seen on govinfosecurity.com Jump to article:…
-
New Microsoft Windows GUI 0-Day Vulnerability Actively Exploited in the Wild
A newly discovered vulnerability in Microsoft Windows, identified by ClearSky Cyber Security, is reportedly being actively exploited by the Chinese state-sponsored Advanced Persistent Threat (APT) group Mustang Panda. The vulnerability, which affects the Windows Explorer graphical user interface (GUI), has been classified as low-severity by Microsoft but poses significant risks due to its exploitation in…
-
Chinese APT ‘Emperor Dragonfly’ Moonlights With Ransomware
Pivoting from prior cyber espionage, the threat group deployed its backdoor tool set to ultimately push out RA World malware, demanding $2 million from its victim. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/chinese-apt-emperor-dragonfly-ransomware-attack
-
Salt Typhoon remains active, hits more telecom networks via Cisco routers
The Chinese nation-state threat group intruded five additional telecom networks between December and January, including two unnamed providers in the U.S., Recorded Future researchers said. First seen on cyberscoop.com Jump to article: cyberscoop.com/salt-typhoon-china-ongoing-telecom-attack-spree/
-
More victims of China’s Salt Typhoon crew emerge: Telcos just now hit via Cisco bugs
Networks in US and beyond compromised by Beijing’s super-snoops pulling off priv-esc attacks First seen on theregister.com Jump to article: www.theregister.com/2025/02/13/salt_typhoon_pwned_7_more/
-
China-backed hackers continue cyberattacks on telecom companies
Salt Typhoon threat actors compromised Cisco edge devices by exploiting older vulnerabilities. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-backed-hackers-continue-cyberattacks-on-telecom-companies/740066/
-
China’s Salt Typhoon hackers targeting Cisco devices used by telcos, universities
Researchers discovered compromised Cisco network devices belonging to telecommunications companies in the U.S. and South Africa, as well as others in Italy and Thailand. First seen on therecord.media Jump to article: therecord.media/china-salt-typhoon-cisco-devices
-
More victims of China’s Salt Typhoon crew emerge Telcos, unis hit via Cisco bugs
Networks in US and beyond compromised by Beijing’s super-snoops First seen on theregister.com Jump to article: www.theregister.com/2025/02/13/salt_typhoon_pwned_7_more/
-
Unusual attack linked to Chinese APT group combines espionage and ransomware
Tags: apt, attack, breach, china, cloud, country, credentials, crime, crimes, crypto, cyber, cybercrime, cyberespionage, data, encryption, espionage, exploit, finance, firewall, government, group, hacker, infection, insurance, intelligence, korea, microsoft, network, north-korea, ransom, ransomware, russia, software, tactics, technology, threat, veeam, vulnerabilityThe attacker demanded a $2-million ransom: The attack that resulted in the deployment of the RA World ransomware program, as well as data exfiltration, had the same chain: the toshdpdb.exe loading toshdpapi.dll then decrypting toshdp.dat which resulted in the PlugX variant being deployed. The difference is the attacker then chose to deploy the RA World…
-
Unpatched Cisco Devices Still Getting Popped by Salt Typhoon
Telecoms Still Falling to Chinese Nation-State Hacking Group, Researchers Warn. A Chinese cyber espionage group tracked as Salt Typhoon and tied to the mass hacking of telecommunications networks in the U.S. and dozens of other countries has been continuing to seek and hack unpatched equipment, including exploiting two long-patched vulnerabilities in Cisco gear. First seen…