News · via SecurityWeek
Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day
Armory Castle exploited CVE-2026-102764 for initial access, deployed custom tools, and deleted logs and artifacts.
China
Coverage tagged "China".
News · via Infosecurity Magazine
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence
News · via The Hacker News
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a…
News · via Recorded Future
TAG-217 Targets South Korean Financial Services with ARTEX
The threat actor linked to recent AI-assisted attacks on South Korean financial institutions was testing infrastructure and assembling attack tools as early as August 2026, weeks before the banking…
News · via CISA
Guangzhou Juan IoT Technology EseeCloud
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to gain control over affected IP cameras. The following versions of Guangzhou Juan IoT Technology EseeCloud…
News · via Infosecurity Magazine
Microsoft Disrupts Global Yam Store Network Behind One Billion Phishing Messages
Microsoft and partners reveal a major Chinese-language phishing network centered around the Yam Store marketplace
News · via Security Affairs
Hirudo Android Trojan Replaces Banking Apps to Steal Credentials
Android trojan Hirudo replaces genuine banking apps with modified versions to steal credentials and bypass security checks, enabling financial fraud. ThreatFabric researchers detailed a new Android…
News · via Zscaler ThreatLabz
Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
IntroductionZscaler ThreatLabz analyzed a recently active exploitation campaign in which a threat actor abused ARTEX to target South Korean financial institutions. ARTEX is an open source agentic…
News · via The Hacker News
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
The U.S. Department of Justice (DoJ) on Tuesday charged 14 people and seized about 187 computers as part of its ongoing efforts to disrupt North Korea's fraudulent remote IT worker (ITW) scheme. The…
News · via The Record
Microsoft takes down 3 major phishing platforms used by Chinese cybercriminals
The tech giant worked with Japan’s National Police Agency and healthcare cybersecurity organization Health-ISAC to obtain a U.S. court order seizing and redirecting domains that were part of the…
News · via SecurityWeek
Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Backed by a federal court order, Microsoft and Health-ISAC seized domains powering YAM Store, CoGUI, and Iron Man.
News · via CyberScoop
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Microsoft collaborated with Japanese authorities, Health-ISAC and several cybersecurity companies to dismantle an expansive, seemingly disconnected ecosystem of Chinese-language cybercrime tools and…
News · via CyberScoop
DOJ charges 14 over a sprawling North Korean remote work scheme
Federal authorities have charged 14 people and seized roughly 187 computers in their newest effort to disrupt North Korea’s remote IT worker scheme. The Justice Department announced the indictment…
News · via SOCRadar
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site
n0n Group Puts Dozens of Global Ports and Shipping on Its Leak Site A month after its first leak site postings, the n0n extortion group has turned its attention to global shipping.
News · via CyberScoop
IonQ to buy zero-trust security firm Elisity in deal valued at up to $1.3 billion
IonQ announced Monday that it will acquire Elisity, a zero-trust network security firm, in an all-stock transaction valued at up to $1.3 billion that folds enterprise access control into the quantum…
News · via ransomware.live
🏴☠️ N0n has just published a new victim : ZPMC (port machinery and terminal engineering)
Port machinery / engineering · China | Operational EDI archives and cargo loading records | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]
News · via ransomware.live
🏴☠️ N0n has just published a new victim : CULines (container shipping)
Container shipping · China | Operational EDI message archives (booking and container manifest records) | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]
News · via SOCRadar
Angi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data Resurface
Angi Data Sale, The Tour Guy Breach, Healthcare Leads, KPN Leak, and CafeMom Data Resurface SOCRadar Dark Web Team identified several new underground posts, including an alleged Angi customer…
News · via Security Affairs
SECURITY AFFAIRS AI-CYBERSECURITY NEWSLETTER ROUND 3
Security Affairs AI-CYBERSECURITY newsletter includes a collection of the best articles and research on AI in the international landscape Artificial intelligence is rapidly changing cybersecurity…
News · via BleepingComputer
ARTEX AI, Claude agents used in cyberattacks on South Korean banks
The cyberattacks that shook the South Korean financial sector earlier this month were launched by a Chinese hacker using the ARTEX AI penetration testing suite and Claude agents.