All news with #china nexus tag

🔒 Mandiant and Google Threat Intelligence Group warn that a suspected PRC-linked actor, ARMORY CASTLE, exploited a critical BeyondTrust Remote Support zero-day to gain root control, access credential vaults, and establish persistence. The flaw, CVE-2026-102764 (CVSS 9.3), affected versions up to 26.2.3 and was patched by BeyondTrust on Oct. 8; self-hosted appliances reachable from the internet during the exploitation window should be treated as potentially compromised. BeyondTrust urges immediate patching, snapshotting of suspect appliances before reboot, and credential rotation only after remediation.

🔍 Microsoft, Health-ISAC, JC3 and private-sector partners disrupted three Chinese-language phishing kits — CoGUI, Haozi and Iron Man System — linked to a marketplace called YAM Store. The court-authorized operation follows an investigation launched in late 2025 after targeted campaigns in Japan; since January 2026 the kits helped send over one billion phishing emails and SMS messages. Microsoft attributes the kits and marketplace to interconnected actors tracked as Storm-2990 and Storm-3119, who used compromised cloud environments and automated tooling to scale credential-stealing campaigns against organizations worldwide.

🛡️ Microsoft uncovered a Chinese-language cybercriminal ecosystem comprising phishing kit developers, an access broker marketplace (YAM Store/Storm-3119), and downstream operators. The kits—CoGUI, Haozi, and Iron Man System (Storm-2990)—enabled the distribution of over one billion phishing emails and SMS messages since January 2026, targeting healthcare, finance, distribution, and IT organizations across multiple countries. Microsoft and partners disrupted the developers and infrastructure in coordination with law enforcement.

🔒 A Chinese-speaking hacker used the ARTEX AI penetration testing suite and Claude agents to target multiple South Korean banks, including Shinhan, KB Kookmin, and Hana. CrowdStrike investigators found attacker infrastructure containing Claude session histories, ARTEX configs, and memory files that linked the incidents to previous financial-sector breaches. The exposure included clients' personal and credit card data and caused outages, prompting an emergency government response and calls for stronger protections for critical IT systems.

📰 The US State Department has offered up to US $10 million for information on Zhang Yu, a 44-year-old alleged member of the Chinese state-linked hacker group Hafnium. Zhang is accused of directing intrusions that exploited zero-day flaws in Microsoft Exchange Server and of stealing data, including COVID-19 research, from US institutions. He is charged alongside Xu Zewei, who was arrested in Italy and extradited to the US; Zhang is believed to be in China and unlikely to be extradited. The bounty aims to pressure his movements and encourage tips despite diplomatic and legal complications.

🛡️ CISA added five vulnerabilities to its Known Exploited Vulnerabilities catalog after a China-linked actor called Flax Typhoon abused them to gain access and exfiltrate data. The flaws span ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND with CVSS scores from 7.2 to 10.0. A joint advisory from multiple nations links the activity to a China-based company, and federal agencies must patch or discontinue affected systems by October 11, 2026.

🛡️ CrowdStrike attributes a late-September to early-October campaign to a suspected China-based actor who used open-source agentic tooling ARTEX and Anthropic’s Claude to identify vulnerabilities and exfiltrate data from South Korean financial firms. The attacker hosted ARTEX and Claude Code artifacts on attacker-controlled IPs and supplemented with multiple LLM backends. Victims include Shinhan Bank and Yegaram Savings Bank, prompting a consumer alert from South Korea’s Financial Services Commission.

🛡️ TA419, a China-aligned cyber espionage group, has run credential phishing campaigns aimed at U.S. AI policy experts at think tanks, universities, and law firms. The actor impersonated economists, policymakers, and an Anthropic employee to phish victims via shortened links that redirect to an OneDrive adversary-in-the-middle (AitM) page using a Frameless BitB technique. Proofpoint links this activity to broader Chinese intelligence objectives amid U.S.–China AI tensions.

🛡️ MI5 has warned that over 100 academics linked to U.K. institutions have contributed to research projects funded by the China General Technology Research Institute (CGTRI), which the agency assesses as a front for the Chinese Ministry of State Security (MSS). The alert cautions that CGTRI-backed research in AI, cybersecurity, covert communications, and steganography directly enhances MSS espionage capabilities. U.K. universities are urged to review collaborations and funding sources immediately, with potential prosecution under the National Security Act 2023 for continuing material assistance.

🔒 A China-linked group known as Warlock exploited Microsoft SharePoint vulnerabilities to compromise a water utility, a telecom operator, a regional government, and a university across Portuguese- and Spanish-speaking regions. The actor used web shells, staged the ransomware in SYSVOL to propagate via Group Policy, and disabled protection on dozens of hosts before deploying the ransomware. Symantec and Carbon Black link the activity to Longlegs and provide IoCs and technical details.

🛡️ Cisco Talos attributes a recent espionage campaign to a China-nexus actor tracked as UAT-11587 that has targeted government and policy organizations across Asia using a previously undocumented Rust-compiled Windows backdoor called Antino. The actor employs tailored spear-phishing lures, sender spoofing, and a multi-stage chain that culminates in DLL sideloading to deploy the implant, which uses Microsoft 365 (Outlook and OneDrive) as its native C2 channel. Talos sees overlaps with known China-aligned clusters but treats UAT-11587 as a distinct activity set.

🛡️ Microsoft Threat Intelligence describes NeedyMantis, a modular post‑compromise malware family observed since October 2025 in targeted intrusions against telecoms, universities, medical nonprofits, intergovernmental organizations, and government contractors. The malware is typically deployed after initial access to maintain persistent access and support follow‑on operations. NeedyMantis uses multiple loaders, a custom encrypted archive format, a bespoke executable layout, and modular components to evade analysis and extend capability. Microsoft links observed activity to Storm‑3069 and activity consistent with Chinese‑aligned threat actors, and provides IOCs, Defender detections, and mitigations.

🛡️ Volexity researchers observed UTA0565 exploiting a newly disclosed Google Chrome–Windows exploit chain on September 3–4, 2026, via fake websites. The actor chained two Chrome flaws (CVE-2026-85046, CVE-2026-87491) with a Windows ALPC vulnerability (CVE-2026-85880) to escape the browser sandbox and achieve remote code execution. Phishing lures impersonated media and NGOs, delivering a BlueMoon-based loader that fetched a CLEANGULP executable named "chrome_cleanup.exe". CLEANGULP provides remote shell, process listing, file upload/download, and BOF execution, and uses a spoofed C2 domain mimicking a legitimate outlet.

🛡️ GreyNoise reports a Chinese-speaking threat actor exploited vulnerabilities across ZyXEL GS1900 switches and WordPress to compromise 996 devices and exfiltrate over 18,500 backend records. The campaign, tied to a group related to Red Heron, leveraged public wp2shell exploits and multiple other CVEs to target governments, small businesses, and infrastructure. Observed activity began in June 2026, with extensive post-exploitation reconnaissance and credential harvesting noted in at least one Western government breach.

🔎 Acronis TRU attributes a rapid, multi-country campaign to suspected China-linked actor Red Heron that weaponized a disclosed Gitea RCE (CVE-2026-60004) to compromise internet-facing instances. The operator scanned and exploited hundreds of servers, stole source code and secrets, and escalated to persistent access and lateral movement, including root control of a Proxmox cluster. Analysts identified a C++ implant JITTERLY and an LD_PRELOAD rootkit SIXZUT used to hide activity and maintain persistence.

🛡️ Check Point Research attributes a sustained SEO fraud and phishing campaign to a Chinese-speaking cluster dubbed Gambling Goblin, active since mid-2025. Attackers implanted custom Apache modules to act as reverse proxies on compromised Brazilian government, education and commercial websites, redirecting specific visitors to localized phishing pages that impersonated app stores and promoted betting. The operation leveraged a broad Linux malware toolkit including AlphaAgent, oRAT and credential stealers, plus reconnaissance tools to map targets.

🔍 A Chinese-speaking cybercrime cluster called Gambling Goblin has been observed installing malicious Apache modules on compromised Brazilian government and educational servers to redirect visitors to attacker-controlled pages promoting online gambling. Check Point Research has tracked the campaign since mid-2025 and found modules that reverse-proxy traffic while stripping security headers so injected content can run. The actors use multiple Linux and reconnaissance tools including DownPro, AlphaAgent, oRAT, and a 3snake-based credential stealer, and the operation appears aimed at large-scale SEO manipulation using high-reputation domains.

🔍 Check Point Research details a campaign by a Chinese-speaking actor dubbed Gambling Goblin that compromises Brazilian government web servers and repurposes them as invisible reverse proxies for phishing pages. The operation installs malicious Apache modules and toolkits to proxy trusted domains to attacker-controlled pages impersonating major app stores, using borrowed reputation to boost SEO and push online gambling. The campaign is linked to the Earth Berberoka cluster and demonstrates an industrialized, scalable fraud model.

🛡️ Last week the US Justice Department and FBI seized domains tied to QScan and QTRouter, platforms used by PRC-linked group QTFY to target US agencies and critical infrastructure. QTFY, operated by Nanjing Xinjiuwei, provided scanning, exploitation, and obfuscation services—turning IoT devices into routing infrastructure for state clients. The takedown highlights how marketized contractors and shared services scale Chinese offensive operations while creating choke points for law enforcement. Experts urge CISOs to shift from IP-based defenses to behavioral visibility, rapid patching, and stronger edge controls.

⚠️ This week’s recap highlights major disruptions and ongoing campaigns, from an FBI takedown of a Chinese proxy network to AI agents and supply-chain failures. Coverage includes router backdoors, chained PaperCut flaws, malware delivered via fake CAPTCHAs, and the evolving tactics of China-linked actors like Fire Ant. Patch and verify trusted infrastructure controls to reduce risk.