News

KP·GBGBHackers

A Kimsuky campaign that delivers Funhouse ransomware through a malicious Hangul document disguised as a resume. The operation combines embedded OLE objects, sequential scripts, a Python backdoor, and Quasar RAT, linking the September 2026 activity to earlier Endpoint ransomware deployments attributed to the group. The findings indicate continuity rather than an entirely new ransomware operation. […] The post Kimsuky Uses Quasar RAT to Deploy Funhouse Ransomware Through Multi-Stage Scripts appear

JP·GBGBHackers

Japanese karaoke operator Daiichi Kosho has issued a warning about a malware infection at its outsourcing partner, Nippon Columbia Group (NCG), that may have exposed about 8.72 million personal records. This potential data exposure includes both customer and employee information, not just customer records. As of now, neither data theft nor misuse has been confirmed, […] The post Nippon Columbia Malware Infection Puts 8.72 Million Daiichikosho Customer Records at Risk appeared first on GBHackers

TW·GBGBHackers

An advanced persistent threat spear-phishing campaign targeting individuals affiliated with Taiwanese research organizations, combining likely AI-assisted event invitations with real-time Google authentication interception. Tracked as UAT-11985, the operation uses institutional impersonation, altered QR codes, and an adversary-in-the-middle phishing framework to steal credentials and authenticated sessions. Attackers repurposed legitimate public event information to make fraudulent invitations [

KR·GBGBHackers

A financially motivated campaign that used agentic AI tools to breach South Korean financial organizations and exfiltrate data. Active from late September to early October 2026, the operation combined ARTEX, an open-source penetration testing platform developed in China, with multiple large language models. Researchers recovered exposed operational files that documented the attacker’s infrastructure, prompts, and […] The post Financially Motivated Hacker Uses Agentic AI to Breach Multiple South

KR·GBGBHackers

Attackers breached two of South Korea’s largest churches through distinct intrusion chains, combining an ERP web shell, privileged database access, leaked credentials, and broken authorization controls. Oasis Security’s analysis of attacker-server files documents extensive collection of congregant, employee, financial, and administrative information across both organizations. Its findings describe recovered attacker artifacts, rather than a complete […] The post Hackers Use ERP Web Shell and IDO

JP·GBGBHackers

Timor-Leste investigators have dismantled a suspected cross-border telecom fraud operation in Dili, detaining 16 individuals accused of impersonating Japanese police officers to defraud victims in Japan. The raid exposed a professionally staged social-engineering setup that included counterfeit law-enforcement props, Japanese-language call scripts and infrastructure designed to lend credibility to “digital arrest” scams. Authorities said the […] The post Japanese Police Impersonation Scam Operat

CN·GBGBHackers

A China-nexus cyber-espionage campaign that compromised approximately 350 endpoints across Asia using a previously undocumented Rust-based Windows backdoor called Antino. The activity cluster, tracked as UAT-11587, targeted government, defense, diplomatic, policy, academic and civil-society organizations in at least eight countries between September 2025 and July 2026. Talos identified 10 confirmed and five probable affected institutional […] The post China-Nexus Hackers Compromise 350 Systems A

KP·GBGBHackers

DPRK-linked operators behind the Cross-Chain TxDataHiding (XCTDH) campaign have expanded their blockchain-backed command-and-control infrastructure with a new Ethereum-based recovery channel dubbed HashHiding. The technique stores an active C2 IP address and port inside the recipient address of ordinary Ethereum transfers, allowing infected systems to recover attacker infrastructure without relying on domains, smart contracts, or transaction […] The post DPRK-Linked Hackers Add HashHiding to Blo

MY·GBGBHackers

SilverFox-linked operators are evolving beyond counterfeit software portals and signed-binary abuse by using visitor-aware delivery infrastructure that can distinguish potential victims from security researchers. Pelagosx recently investigated a related Windows malware delivery chain that began with a finance-themed WhatsApp message targeting Malaysian users. The message urged recipients to forward a report for verification and open […] The post SilverFox Built Fake Software Sites That Know When

AU·GBGBHackers

Research from Transluce shows that autonomous AI agents shifted from standard web data collection to probing for vulnerabilities in three public-facing services after traditional data retrieval methods failed. This activity targeted an Australian government health data platform, Data USA, and the University of New Mexico’s digital library. Rogue AI Tried to Hack Public Websites Transluce […] The post Rogue AI Agents Tried to Hack Public Websites After Data Retrieval Failed appeared first on GBHa

KP·GBGBHackers

North Korea-linked threat actor Konni has launched a targeted cyberespionage operation against Ukraine-focused entities using malicious Windows shortcut files disguised as PDF documents. The campaign, tracked by SOCRadar Threat Research Unit as Operation Conflict Compass, deploys a modular PowerShell malware family dubbed VelvetCake to collect intelligence on the Russia-Ukraine war. The activity appears designed to […] The post Operation Conflict Compass Deploys VelvetCake PowerShell Malware Thr

CN·GBGBHackers

A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome. It followed Volexity’s September 9 disclosure that UTA0560 and […] The post Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits appeared first on GBHack

IN·GBGBHackers

North Korea-linked threat actor TraderTraitor has expanded its developer-focused intrusion activity beyond cryptocurrency targets, using weaponized Terraform lock files in fake job-interview repositories to infect DevOps engineers with macOS backdoors. SentinelOne identified an Indian IT services provider compromised with the same FLATROOF and ROOFDECK implants previously linked to the April 2026 KelpDAO-LayerZero attack. The campaign […] The post Hackers Weaponize Terraform Lock Files to Infect

KP·GBGBHackers

North Korean threat actors, known as WaterPlum (also referred to as Contagious Interview), have infected at least 30,000 devices in over 100 countries by luring software developers and IT professionals into malicious job interviews. This campaign specifically targets web developers, freelancers, blockchain specialists, and cryptocurrency professionals. The attackers use persuasive recruitment messages that mimic legitimate […] The post North Korean WaterPlum Hackers Target IT Professionals With

CN·GBGBHackers

China-aligned threat actors are using low-quality Chinese-language casino and adult websites to conceal PeckBirdy command-and-control infrastructure, creating a detection challenge for enterprises that routinely deprioritize gambling-related domains. Infoblox telemetry found that just over 3% of enterprise customers resolved at least one PeckBirdy-related C2 domain, indicating that the infrastructure is appearing well beyond the campaign’s apparent […] The post PeckBirdy C2 Traffic Seen Across E

CN·GBGBHackers

China-aligned advanced persistent threat group FamousSparrow has replaced its long-running SparrowDoor implant with a new modular C++ backdoor, SparroWocky, in a sustained cyberespionage campaign against government entities across Latin America. ESET says the malware has been active in the region since at least August 2025, following a sharp shift in the group’s victim targeting that […] The post FamousSparrow Deploys New SparroWocky Backdoor Against Latin American Governments appeared first on

CN·GBGBHackers

RatHat, a newly identified Android banking malware family that combines Accessibility abuse, local Android Debug Bridge (ADB) pairing, native shell-level components, and generative-AI-assisted interface automation. The operation appears linked to China-based threat actors and is primarily designed to steal banking credentials, payment PINs, one-time passwords, device-unlock secrets, and other high-value data from infected Android devices. […] The post RatHat Abuses Android Wireless Debugging to

TH·GBGBHackers

Security researchers have revealed two vulnerabilities in TP-Link’s Tapo C200 smart camera that could enable nearby network attackers to bypass administrator authentication or disrupt the device’s management service. Khoi Tran and Thai Do from OPSWAT Unit 515 discovered these vulnerabilities, tracked as CVE-2026-15315 and CVE-2026-15316, during the company’s Critical Infrastructure Cybersecurity Graduate Fellowship Program. TP-Link […] The post TP-Link Tapo Camera Flaw Lets Attackers Gain Admin

CN·GBGBHackers

Chinese-speaking threat actors are continuing to rely on Noodle RAT, a cross-platform remote access trojan designed to maintain covert access to compromised Windows workstations and Linux servers. Also tracked as ANGRYREBEL and Nood RAT, the malware has been active since at least mid-2016 but was long mistaken for variants of Gh0st RAT, Rekoobe, and other […] The post Chinese-Speaking Hackers Use Noodle RAT Backdoor to Spy on Windows and Linux Systems appeared first on GBHackers Security | #1 Gl

CN·GBGBHackers

A Chinese-speaking threat actor known as Red Heron has exploited a critical remote code execution (RCE) vulnerability in Gitea to steal private source code, harvest credentials, establish persistent access, and move laterally within victim infrastructures. Researchers from the Acronis Threat Research Unit (TRU) have linked this operation to a newly documented Linux implant called JITTERLY, […] The post Red Heron Hackers Exploit Critical Gitea RCE to Steal Source Code and Deploy Linux Rootkit app

CN·GBGBHackers

China-linked threat actors tracked as UNC3569 have exploited a critical one-click remote code execution vulnerability in Tencent’s Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor on targeted systems. Tracked as CVE-2026-51990, the vulnerability chains an insecure custom protocol handler, unrestricted embedded-browser navigation, and an obsolete Chromium build running without sandbox protections. Tencent addressed […] The post China-Linked Hackers Exploit Sogou One-Click RCE to D

CN·GBGBHackers

China-linked threat actors UTA0560 and JungleBamboo chained a Google Chrome zero-day with a Windows kernel privilege-escalation flaw in phishing campaigns targeting NGOs and other victims. Volexity documented the operations, detected on September 1, 2026, as using identical browser-to-kernel exploit components but ultimately installing separate espionage payloads: the GRIMWEDGE JScript backdoor and the LONGTALE credential-stealing Chrome […] The post China-Linked Hackers Chain Chrome Zero-Day Wi

AU·GBGBHackers

A swarm of AI agents believed to be operated internally by OpenAI uploaded more than 2,000 malicious packages to RubyGems in May 2026, abusing the ecosystem’s documentation build process to execute code remotely and attempting to steal user API keys through a then-undisclosed server-side flaw. Researchers Spencer Kitts, Thomas Larsen, and Sydney Von Arx said […] The post OpenAI Agents Flood RubyGems With 2,000 Packages and Exploit Build System for RCE appeared first on GBHackers Security | #1 Gl

PH·GBGBHackers

Suspected Chinese-speaking operators exploited the critical ownCloud flaw CVE-2023-49105 to steal nuclear material records, research reactor data, personnel files, and encryption key material from a Philippine nuclear research organization. Hunt.io discovered an exposed file directory on August 13, 2026, hosted at 31.58.209[.]241:8000, an Amsterdam-based server registered to CGI Global Limited. The directory was served through […] The post Hackers Exploit CVE-2023-49105 to Steal Nuclear Records

CN·GBGBHackers

The U.S. Justice Department and the FBI have seized domains associated with two hacking platforms linked to China, QScan and QTRouter. This court-authorized operation aims to disrupt attacks against U.S. critical infrastructure and sensitive government networks. Unsealed court documents from the Southern District of California revealed that these platforms were operated by a state-sponsored group […] The post FBI Seizes China State-Sponsored Hacker Platforms Used to Target U.S. Critical Infrastr

KP·GBGBHackers

North Korean state-backed threat actor Kimsuky is extending its established espionage playbook with locally hosted artificial intelligence tooling, according to new research into an activity cluster tracked as Operation GitPower. The campaign retains familiar phishing-led intrusion chains but shows the operators preparing AI-assisted capabilities for malware development, data analysis, social engineering, and operational automation. The […] The post Kimsuky Uses Local AI Development Environment

CN·GBGBHackers

HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit that can conceal malware artifacts and command-and-control infrastructure from security tools. The development marks a notable escalation in the group’s post-compromise tradecraft, moving protection and evasion below the user-mode layer where many endpoint inspection […] The post HoneyMyte Upgrades CoolClient With Windows Kernel Rootkit to Hid