News

CN·CTCisco Talos

Cisco Talos discovered a Chinese-speaking cybercrime group, tracked as UAT-10147, that targets a wide range of vulnerable web servers. This is an overview of the campaign, examining the countries affected, potential impact of BadIIS infections, the attack chain, and post-compromise tactics.

IN·ECET CISO

Sebi will soon issue guidelines for responsible AI and machine learning use in India’s securities market, with mandatory safeguards including a “kill switch”, human oversight and data controls. Chairman Tuhin Kanta Pandey said the framework will balance innovation with investor protection as AI adoption expands across surveillance, risk assessment, fraud detection and investor servicing, while ensuring accountability among regulated entities.

JP·BLBleepingComputer

Japanese cloud and data center service provider Sakura Internet disclosed that hackers accessed its sales management system, where customer contract and membership information is stored. [...]

CN·DRDark Reading

A spear-phishing campaign by a Chinese-nexus group linked to FamousSparrow provides insight into geopolitical, technical, and strategic global moves by China's APTs.

MM·CSCyber Security News

A China-nexus cyber espionage campaign is using a convincing visual trick to reach Myanmar government and technology personnel. The attackers present a virtual hard disk, or VHD, as an ordinary JPEG image, betting that recipients will not question a familiar file extension before opening it. Inside the mounted disk is what appears to be an […] The post China-Nexus Hackers Disguise Malicious VHD as JPEG to Deploy QUICAgent Backdoor appeared first on Cyber Security News .

JP·AAAhnLab ASEC

ASEC Blog publishes Ransom & Dark Web Issues Week 3, August 2026 Customer and Operational Data of a South Korean Delivery Platform Offered for Sale Unauthorized Access Incident at a Japanese Cloud and Data Center Services Company ShinyHunters Threatens Data Disclosure Against a U.S. Live-Streaming Platform

KR·AAAhnLab ASEC

Purpose and Scope The July 2026 Threat Trend Report on APT Groups summarizes the trend in which state-sponsored threat actors and financially motivated attackers are employing a combination of supply chain attacks, account takeovers, cloud breaches, and social engineering techniques. Key targets include Microsoft 365, webmail accounts, cloud infrastructure, GitHub and development environments, VPN and […]

AU·REThe Register

Unknown parties know where you stayed last summer, down under, across 120 Quest properties

CN·DRDark Reading

In the first purported "near-autonomous" attack on a nation-state, a Chinese-language operator used a complex AI framework to target and compromise government agencies, likely in Taiwan.

CN·BABankInfoSecurity

SilkParasite Deployed Against Central Asian Governments Bitdefender said the China-linked SilkParasite espionage campaign deployed seven modular RATs against Central Asian governments, with coding artifacts indicating AI assisted expert developers rather than generating the stealth-focused malware itself.

CN·CLCloudSEK

CloudSEK uncovered a Chinese-speaking threat operator using autonomous AI coding agents to scale cyberattacks, including mass WordPress compromise, cryptocurrency wallet theft, credential harvesting and cryptojacking. The exposed infrastructure also revealed a developing blockchain-based command-and-control system designed to make future operations more resilient to takedowns. Authors : Ayush Panwar

HK·HKHKCERT

<p style="text-align: justify;"><img alt="" class="respon-img" src="/preview/f/blog/914588/919406/0p0/image-professional-cybersecurity-advisory-styl-2026-07-17T06-43-47-239Z.jpg" /></p> <p align="center"><span>(Image generated by generative AI and reviewed under professional human supervision.)</span></p> <p style="text-align: center;">&nbsp;</p> <p>Quantum computing has made significant advances in recent years. Its immense computational power has quickly become a major topic of discussion and

KP·GBGBHackers

North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower. The campaign retains familiar phishing-led intrusion chains but shows the operators preparing AI-assisted capabilities for malware development, data analysis, social engineering, and operational automation. The […] The post Kimsuky Uses Local AI Development Environment

CN·BABankInfoSecurity

Draft Covered List Expansion Would Reach Components Inside AI Data Center Switches The U.S. FCC reportedly may restrict imports of new-model optical transceivers made in China, a move that would reach AI data center interconnects for the first time and leaves open how regulators would define origin, what counts as a new model and whether switches keep authorization.

KP·RFRecorded Future

Learn how North Korean IT worker threat cluster "PurpleDelta" uses AI-generated personas, sophisticated tradecraft, and custom ChatGPT assistants to infiltrate organizations. Discover key indicators of compromise and mitigation strategies to protect your company from these fraudulent employment operations.

MM·SESeqrite Labs

Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Campaign Timeline Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – LNK-Based Initial Access Stage 2 – Split Payload Reconstruction via ftp Script Stage 3 – QUICAgent Implant – Go-Based Backdoor Infrastructure & Attribution Conclusion SEQRITE Protection Indicators of Compromise (IOCs) MITRE […] The post Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Deli

CN·GBGBHackers

HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit that can conceal malware artifacts and command-and-control infrastructure from security tools. The development marks a notable escalation in the group’s post-compromise tradecraft, moving protection and evasion below the user-mode layer where many endpoint inspection […] The post HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hid

PK·CSCyber Security News

HoneyMyte has upgraded its CoolClient backdoor with a kernel-level rootkit for Windows. The change makes routine investigation much harder for defenders. It gives intruders tools designed to survive ordinary security checks. The activity targeted organizations in Pakistan, Mongolia, Myanmar and Russia, including government entities. In Myanmar, attackers first used PlugX, then installed CoolClient as a […] The post HoneyMyte CoolClient Backdoor Uses Signed Kernel Rootkit to Hide Processes, Files

CN·HNThe Hacker News

Cybersecurity researchers have attributed the exploitation of a newly patched security flaw in Broadcom VMware vCenter to a suspected China-nexus advanced persistent threat (APT). The attacks involve the exploitation of CVE-2026-59310 (CVSS score: 9.8), a severe directory-traversal vulnerability in the VMware vCenter server that could be weaponized by a malicious actor to execute arbitrary code

IN·REThe Register

PLUS: HCL, TCS, admit data breaches; Google, Apple, India bans some rideshare tips; and more!

APAC·SASecurity Affairs

Acronis uncovered PATCHCORD, a stealthy backdoor targeting Afghan telecom and South Asian infrastructure via fake VPN tools and Google Sheets C2. Researchers at Acronis just documented an espionage operation that reads like it was built by someone with genuinely good taste in disguises. Their Threat Research Unit report tracks a previously undocumented backdoor called PATCHCORD, […]

TH·HIHunt.ioResearch

An exposed open directory on a Hong Kong server revealed an autonomous AI agent running unattended, an unreported Go implant, and target-specific tooling used against Thailand's Ministry of Finance.

CN·HIHunt.ioResearch

An exposed open directory revealed a suspected Chinese campaign using Claude Code and DeepSeek-v4-pro to breach government systems in Afghanistan, Thailand, and Taiwan, with parallel probing of financial services worldwide.

JP·HIHunt.ioResearch

An exposed API on a Japanese phishing server revealed Canis C2, a previously undocumented surveillance framework targeting Android, iOS, Windows, Linux, and macOS.

KP·HIHunt.ioResearch

The axios npm maintainer account was hijacked to push two malicious versions. Inside: an obfuscated postinstall dropper, three platform-specific RATs, self-destructing cleanup, and C2 infrastructure linked to TA444/BlueNoroff

CN·BTBitsight TRACEResearch

Bitsight Research

CN·HIHunt.ioResearch

Discover how we mapped over 18,000 active malware C2 servers across Chinese ISPs and cloud providers using host-centric telemetry. See which providers are most frequently abused and what it means for global threat monitoring.

KP·HIHunt.ioResearch

Deep investigation into DPRK activity, revealing new Lazarus and Kimsuky infrastructure through multi-stage hunts and exposed operational patterns.

APAC·HIHunt.ioResearch

Hunt.io maps phishing campaigns using shared ZIP payload infrastructure targeting financial institutions and government organizations across Asia. Learn more.

APAC·HIHunt.ioResearch

SideWinder’s Operation SouthNet: South Asia phishing on Netlify/pages.dev, Zimbra/Outlook lures, and open directories. Maritime focus. IOCs included. Learn more.