china news
11 stories
'Warlock' ransomware used in attacks on critical infrastructure in Portuguese, Spanish-speaking countries
A Chinese threat group is reportedly deploying "Warlock" ransomware in attacks targeting critical infrastructure organizations in Portuguese and Spanish-speaking countries. The campaign exploits various vulnerabilities within Microsoft SharePoint, according to recent analysis from the Symantec Threat Hunter Team.
Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
A suspected Chinese-speaking threat actor has reportedly breached a Philippine nuclear research body and a marine engineering company that provides services to the Philippine Navy, exploiting known vulnerabilities in internet-facing systems to exfiltrate sensitive data. The activity was uncovered by Hunt.io Attack Capture, which identified an exposed server in Amsterdam containing attack…
China Launches Cybersecurity Review of Palo Alto Networks Products
China's Cyberspace Administration (CAC) has initiated a cybersecurity review of Palo Alto Networks products sold within the country, citing national security concerns. The announcement from the CAC, published in formal Chinese, referenced the National Security Law and the Cybersecurity Law of the People's Republic of China, as well as the Cybersecurity Review Measures, as the legal basis for…
Chinese APT Group Linked to DigiCert Breach and Code Signing Certificate Theft
A recent report indicates that a Chinese Advanced Persistent Threat (APT) group has been implicated in a security breach at DigiCert, leading to the theft of code-signing certificates. The group, identified by researchers under the monikers GoldenEyeDog and CylindricalCanine, is known for its previous targeting of sectors such as gambling and gaming.
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors
Cybersecurity researchers have identified an expansion in the arsenal of a China-linked advanced persistent threat (APT) group, known for its operations under the name LapDogs. This threat actor has reportedly introduced new malware components, specifically focusing on compromising small office/home office (SOHO) routers. The newly identified backdoors have been named LongLeash, DogLeash, and…
China-Linked APT Expands Proxy Network With New Malware
A China-linked advanced persistent threat (APT) group, identified as UAT-7810, has been observed expanding its network of compromised devices, known as Operational Relay Box (ORB) networks, and equipping it with new custom malware. Researchers at Cisco Talos assessed with high confidence that UAT-7810 is a China-nexus group. These ORB networks consist of hijacked routers and other devices that…
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
A Chinese-linked threat actor identified as UAT-7810 is reportedly expanding its network of compromised devices, known as the Operational Relay Box (ORB) network, by deploying new custom malware. Cisco Talos researchers have observed this actor compromising internet-facing networking devices to achieve this expansion.
Chinese hackers develop LONGLEASH malware to expand ORB network
Chinese threat actors, identified as UAT-7810, are actively developing and deploying new malware to enhance their Operational Relay Box (ORB) network. This network, previously documented as a secure relay infrastructure for other China-aligned advanced persistent threat groups, is being expanded by compromising internet-facing networking devices, with a particular focus on unpatched Ruckus…
Suspected Chinese Threat Group Targets Universities via Vulnerable Roundcube Servers
A suspected China-aligned threat group, tracked by researchers as UNK_MassTraction, has been actively exploiting vulnerabilities in Roundcube webmail servers to gain access to academic institutions in the United States and Canada. The primary targets appear to be physics and engineering departments, with potential connections to national security interests.
Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities
A new cyberattack campaign has been detected, specifically targeting academic institutions in North America. The perpetrators of this campaign are suspected to be aligned with China and are leveraging security weaknesses in the Roundcube webmail system. The attacks appear to be concentrated on physics and engineering departments within these universities.
Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities
China-aligned attackers have targeted U.S. and Canadian universities, exploiting a chain of vulnerabilities in the Roundcube webmail client to gain unauthorized access to sensitive data and establish persistent footholds within academic networks. The campaign, observed by Proofpoint researchers since May, appears to be ongoing and has primarily focused on physics and engineering departments,…