Palo Alto Networks has not attributed the APT activity to any specific country, but evidence points to China.
The post Cyberspy Group Hacked Governments and Critical Infrastructure in 37 Countries appeared first on SecurityWeek.
Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit
The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.
The post Chinese APT Mustang Panda Caught Using Kernel-Mode Rootkit appeared first on SecurityWeek.
UK Government Acknowledges It Is Investigating Cyber Incident After Media Reports
The British government is investigating a “cyber incident” following news reports that hackers linked to China have gained access to thousands of confidential documents.
The post UK Government Acknowledges It Is Investigating Cyber Incident After Media Reports appeared first on SecurityWeek.
Chinese APT ‘LongNosedGoblin’ Targeting Asian Governments
The hacking group has been using Group Policy to deploy cyberespionage tools on governmental networks.
The post Chinese APT ‘LongNosedGoblin’ Targeting Asian Governments appeared first on SecurityWeek.
China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear
The critical zero-day is tracked as CVE-2025-20393 and it impacts Secure Email Gateway and Secure Email and Web Manager appliances.
The post China-Linked Hackers Exploiting Zero-Day in Cisco Security Gear appeared first on SecurityWeek.
Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery
Google has also mentioned seeing React2Shell attacks conducted by Iranian threat actors.
The post Google Sees 5 Chinese Groups Exploiting React2Shell for Malware Delivery appeared first on SecurityWeek.
Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks
APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads.
The post Chinese Cyberspies Deploy ‘BadAudio’ Malware via Supply Chain Attacks appeared first on SecurityWeek.
Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’
A Chinese threat actor is exploiting known vulnerabilities in discontinued Asus devices in an Operational Relay Box (ORB) facilitation campaign.
The post Over 50,000 Asus Routers Hacked in ‘Operation WrtHug’ appeared first on SecurityWeek.
Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign
A state-sponsored threat actor manipulated Claude Code to execute cyberattacks on roughly 30 organizations worldwide.
The post Anthropic Says Claude AI Powered 90% of Chinese Espionage Campaign appeared first on SecurityWeek.
Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks
PowerShell and .NET variants of the malware abuse AirWatch’s MDM API to establish a C&C communication channel.
The post Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks appeared first on SecurityWeek.
