News
Cybersecurity news across South Asia and the wider Asia-Pacific — everything from Bangladesh, India, Pakistan, Sri Lanka, and Nepal, plus high-signal incidents from the region. Collected hourly, deduped across outlets.
- Stories in view
- 141 stories
- Countries covered
- 22 countries
- Outlets
- 29 outlets
- Latest story
- 40d ago latest
Filter the wire
+23 more
showing CN · clear all
Wed 2 Sept4
CN
The Hacker News
An active malware campaign is using bogus software-download websites to impersonate trusted vendors and distribute malicious installers. "The campaign has targeted users looking to download popular software and has resulted in compromises across multiple organizations and industries, primarily affecting China-based operations of multinational organizations and Chinese-speaking users," Microsoft
CN
Hackread
Intel 471 says Chinese-speaking operators used fake streaming apps and Facebook ads to infect Android users with the PanDa RAT (remote access trojan).
Gaming the system: how a Chinese-speaking actor turned Brazilian government sites into an SEO weapon
41d agoCN
Check Point Research
Research by: Amit Yardeni Key Points Introduction Since mid-2025, Check Point Research has tracked a sustained campaign against Brazilian organizations. The tradecraft points to a Chinese-speaking cybercrime group connected to Earth Berberoka, an actor first documented targeting gambling sites across Asia. Once inside a victim, the group deploys a broad Linux toolkit: a custom downloader, several backdoors, […] The post Gaming the system: how a Chinese-speaking actor turned Brazilian government
CN
The Record
A hacking operation dubbed Fire Ant "didn’t just compromise systems," according to researchers. "It compromised the trust layer those systems depend on."
Tue 1 Sept2
CN
The Cyber Express
The China-nexus espionage group Fire Ant has moved from compromising virtualization platforms to implanting Cisco IOS XR routers and TACACS authentication servers. They are using them to capture traffic, harvest administrator credentials and suppress the logs defenders rely on, said researchers at Sygnia, an incident response firm. Researchers first documented Fire Ant in July 2025 for deep intrusions into VMware ESXi and vCenter environments. The new report describes the same actor operating a
CN
Sygnia details Fire Ant attacks on Cisco routers, TACACS servers and Linux hosts used to steal credentials, collect traffic data and conceal malicious activity.
Mon 31 Aug5
CN
BleepingComputer
The researchers discovered Fire Ant's new tactic after finding an active GRE (Generic Routing Encapsulation) tunnel interface on a Cisco IOS XR router that could not be explained by a running configuration or commit history. [...]
CN
The boring parts caused most of the trouble. A router shipped ready to listen. A fake check turned the user into the installer. Trusted systems collected traffic and passwords, then cleaned the logs. Old bugs formed new attack chains. Even an AI agent decided its assigned task was optional. Elsewhere, fake apps, helpful support calls, cheap banking kits, exposed systems, and weak defaults kept
CN
Security Affairs
Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks. Chinese-linked cyber espionage group Fire Ant has spent the past year quietly graduating from hacking individual computers to hacking the infrastructure that connects them. Sygnia’s new report traces how the group expanded from compromising […]
CN
A China-nexus cyber espionage actor tracked as Fire Ant has expanded a long-running campaign beyond VMware hypervisors to compromise Cisco IOS XR routers, Terminal Access Controller Access-Control System (TACACS) servers, and Linux management hosts used to route, authenticate, and manage high-value networks. Sygnia, the incident response firm that investigated the intrusion, said the actor
CN
The U.S. Department of Justice (DoJ) on Friday corrected a previously issued press statement that several of its agencies were victims of attacks carried out by Chinese threat actors, instead now pointing out that they were among those targeted. Last week, the DoJ said the National Aeronautics and Space Administration, Federal Reserve, Department of Energy, Department of Justice, Department
Sat 29 Aug1
CN
DataBreaches.net
AJ Vicens and Raphael Satter report: U.S. officials are backpedaling on claims that several government agencies were hacked by Chinese spies, now saying that the organizations were among the hackers’ targets. In a freshly edited statement, the Justice Department said Friday that the U.S. Senate, the Federal Reserve, NASA, and others were “among the targets... Source
Fri 28 Aug5
CN
Cyber Security News
A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing […] The post Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix appeared first on Cyber Security News .
CN
A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing […] The post Hackers Use Fake Student Resume to Secretly Install Malware on Researchers’ Computers appeared first on Cyber Security News .
CN
VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the ability to run commands as root on affected devices. The implants, named SPEAKINGSTONE and DARKLANTERN by the company's zero-day research team, are tracked as CVE-2026-74232 and CVE-2026-74233.
CN
The FBI and DOJ disrupted a global botnet used by QTFY to compromise IoT devices and conceal attacks against US government agencies and critical infrastructure.
CN
Dark Reading
An untold numbers of ZBT routers sold around the world as white-label products come with several implants built by the manufacturer.
Thu 27 Aug7
Federal authorities disrupt China-backed hacking operation targeting US critical infrastructure
47d agoCN
Cybersecurity Dive
Compromised IoT devices were used in a yearslong campaign against key sectors and U.S. government agencies.
CN
Infosecurity Magazine
The FBI advisory set out QTFY’s distributed hacking ecosystem, allowing it to exploit vulnerabilities at scale and obfuscate its activities
FBI Seizes China State-Sponsored Hacker Platforms Used to Target U.S. Critical Infrastructure
47d agoCN
GBHackers
The U.S. Justice Department and the FBI have seized domains associated with two hacking platforms linked to China, QScan and QTRouter. This court-authorized operation aims to disrupt attacks against U.S. critical infrastructure and sensitive government networks. Unsealed court documents from the Southern District of California revealed that these platforms were operated by a state-sponsored group […] The post FBI Seizes China State-Sponsored Hacker Platforms Used to Target U.S. Critical Infrastr
CN
The U.S. Department of Justice and FBI have seized domains associated with two China-linked hacking platforms, QScan and QTRouter, allegedly used to target NASA, federal agencies, critical infrastructure, and sensitive U.S. networks. Court documents unsealed in the Southern District of California link the infrastructure to a People’s Republic of China state-sponsored group tracked as QTFY. […] The post FBI Shuts Down China-Linked Hacking Platforms Used to Target NASA and U.S. Networks appeared f
CN
SecurityWeek
The operation focused on a group named QTFY, which offers hacking services to the Chinese government and others. The post US Disrupts Chinese Hacking Platform Used in Military and Critical Infrastructure Attacks appeared first on SecurityWeek .
CN
The Register
Beijing's
CN
CyberScoop
The full hacking suite, seized by authorities, allowed Chinese government funded attackers to intrude highly sensitive networks undetected for more than eight years. The post Officials disrupt Chinese espionage operation that hit multiple federal agencies appeared first on CyberScoop .
Wed 26 Aug4
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
47d agoCN
FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U.S. critical infrastructure. The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a China-linked group to hide cyberattacks and target critical infrastructure. The operation matters because it shows how state-backed actors no longer need […]
CN
Jonathan Greig reports; Chinese government hackers used tools known as “QScan” and “QTRouter” to breach multiple federal agencies since 2018, the Department of Justice said in announcing the takedown of the platforms on Wednesday. The tools were run by China-based Nanjing Xinjiuwei Network Technology Company and used primarily by China’s Ministry of State Security and... Source
CN
The U.S. Department of Justice (DoJ) on Wednesday announced the disruption of two hacking platforms named QScan and QTRouter operated by Chinese threat actors to target critical infrastructure and other sensitive networks in the country. The activity has been attributed to a Chinese state-sponsored group known as QTFY, employed by Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司).&
CN
The FBI has disrupted infrastructure associated with a technical "quartermaster" that provided reconnaissance, proxy management, and operational routing capabilities for Chinese cyber espionage activities. [...]
Fri 21 Aug2
CN
A Chinese-speaking cybercrime group is using AI-assisted tools to turn vulnerable web servers into entry points. It shows how familiar flaws become more dangerous when attackers automate the work around them. The group, tracked as UAT-10147, targeted internet-facing Windows and Linux systems in government, education, media, technology, and gaming. Victims were identified across several countries, […] The post Chinese Hackers Use AI Agents to Exploit Web Servers and Automate Attacks appeared firs
CN
Suspected military-grade hackers based in China used artificial intelligence to develop malware in a campaign to penetrate Central Asian governments.
Thu 20 Aug1
CN
Cisco Talos
Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.
Wed 19 Aug4
CN
A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into geopolitical, technical, and strategic global moves by China's APTs.
CN
In the first purported "near-autonomous" attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan.
CN
BankInfoSecurity
SilkParasite Deployed Against Central Asian Governments Bitdefender said the China-linked SilkParasite espionage campaign deployed seven modular RATs against Central Asian governments, with coding artifacts indicating AI assisted expert developers rather than generating the stealth-focused malware itself.
CN
CloudSEK
CloudSEK uncovered a Chinese-speaking threat operator using autonomous AI coding agents to scale cyberattacks, including mass WordPress compromise, cryptocurrency wallet theft, credential harvesting and cryptojacking. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations more resilient to takedowns. Authors : Ayush Panwar
Tue 18 Aug1
CN
Draft Covered List Expansion Would Reach Components Inside AI Data Center Switches The U.S. FCC reportedly may restrict imports of new-model optical transceivers made in China, a move that would reach AI data center interconnects for the first time and leaves open how regulators would define origin, what counts as a new model and whether switches keep authorization.
Mon 17 Aug2
CN
HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit that can conceal malware artifacts and command-and-control infrastructure from security tools. The development marks a notable escalation in the group’s post-compromise tradecraft, moving protection and evasion below the user-mode layer where many endpoint inspection […] The post HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hid
CN
Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code
Tue 14 Jul1
CN
Hunt.ioResearch
An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.
Wed 18 Feb1
CN
Bitsight TRACEResearch
Bitsight Research
Wed 14 Jan1
CN
Discover how we mapped over 18,000 active malware C2 servers across Chinese ISPs and cloud providers using host-centric telemetry. See which providers are most frequently abused and what it means for global threat monitoring.