Tag: espionage
238 articles
Chinese hackers exploit BeyondTrust zero-day in espionage push
Chinese hackers have been exploiting a critical zero-day vulnerability in BeyondTrust Remote Support, first detected on August 29, in a sophisticated espionage campaign attributed to the threat group Armory Castle. A patch was released on October 8 to fix the defect, tracked as CVE-2026-102764.
AI-Powered Attacks Target Government Linux Infrastructure
Meet CL-UNK-1211, a sneaky AI-powered espionage campaign that infiltrated government entities and state-affiliated infrastructure between October 2025 and April 2026. The attackers cleverly embedded AI into their workflow, using conversational annotations and step-by-step notes that hinted at automated code generation.
OpenAI Engineer Charged with Planting Secret Recording Device
An OpenAI engineer allegedly planted a sneaky recording device in the company's executive conference room to capture sensitive chats about its top-secret super intelligence tech. The shocking discovery was made when staff stumbled upon the hidden gadget concealed in toilet paper.
OpenAI Engineer Arrested for Planting Hidden Recorder in Executive Conference Room
Meet the OpenAI engineer who allegedly took secrecy to a whole new level by hiding a recording device in his employer's executive conference room to capture sensitive intel on super intelligence technology. He now faces up to five years in prison and a hefty fine for his covert actions.
OpenAI Engineer Arrested for Planting Hidden Recording Device
A shocking case of corporate espionage has come to light with the arrest of OpenAI engineer Abdulrahman Alfozan, who allegedly planted a hidden recording device in an executive conference room, sparking a federal investigation. If convicted, Alfozan faces up to five years in prison and a hefty $250,000 fine.
MI5 Warns UK Academics Funded by China's Spy Agency
MI5 has issued a stark warning to UK academics: over 100 researchers have unwittingly contributed to projects funded by China's spy agency, which aims to boost its espionage capabilities. This alarming revelation has raised serious national security concerns in the UK.
MI5 Warns Academics Over Unwitting Role in China's Espionage Plans
Beware: over 100 UK academics have unknowingly contributed to projects backed by a Chinese institute that's secretly boosting China's espionage capabilities. MI5 has sounded the alarm, warning researchers about the China General Technology Research Institute's true ties to China's Ministry of State Security.
Iran-Linked Malware Exploits Telegram for Password Theft
Meet HEAVYGRAM, a sneaky Telegram backdoor linked to Iran that's packed with espionage capabilities, from snapping screenshots to siphoning off sensitive data, and controlled remotely by its masters. This malicious tool has been quietly lurking in the shadows since September 2023, leaving a trail of compromised systems in its wake.
China's Salt Typhoon Targets Latin America with Sophisticated Backdoor Malware
Meet Salt Typhoon, a notorious PRC-backed espionage group that's set its sights on Latin America, infecting government agencies with sophisticated backdoor malware. In just a few months, they've targeted a whopping 90% of their victims in the region, hitting countries including Argentina, Ecuador, and Venezuela.
Iranian Hackers Deploy CHOSEN BRICK Malware to Spy on Global Targets
Meet CHOSEN BRICK, a sneaky Windows malware that's been used by Iranian hackers to turn everyday apps into long-term spying tools, helping the regime silence dissidents, activists, and journalists worldwide. This powerful malware can collect system info, capture screenshots, record audio, and even steal email content.
Malware Exploits Chinese Casino Sites for Espionage
Uncover the dark side of Chinese-language casino sites: a vast network of seemingly harmless online casinos and adult sites is secretly harboring malware, facilitating espionage, and laundering money - with ties to major US cloud providers. These sites cleverly disguise themselves as legitimate entertainment hubs, using common templates and relying on the house edge to turn a profit.
Anthropic Disrupts Russian Hackers' AI-Driven Malware Rebuild Efforts
Anthropic has successfully disrupted the AI-driven malware rebuild efforts of Russian hackers, dealing a significant blow to their operations. The hackers had been using AI to refine their malware and evade detection by security defenses.
Multiple Spy Groups Exploit Chrome, Windows Flaws with BlueMoon Kit
Multiple spy groups are rapidly adopting the BlueMoon exploit kit, leveraging vulnerabilities in Google Chrome and Microsoft Windows to carry out espionage operations, with a suspected China nexus. This kit chains together flaws in Chrome's V8 JavaScript engine and Windows, including several zero-day exploits.
Lawmakers Urge Treasury to Target Indian Hack-for-Hire Groups
US lawmakers are calling on the Treasury Department to take action against Indian hack-for-hire groups that have been targeting American citizens and businesses for over 15 years. By adding these firms to the Entity List, they aim to restrict their access to US software, tools, and infrastructure.
Threat Actors Exploit AI for Large-Scale Credential Harvesting
Threat actors are supercharging their attacks with AI, using it to scale up credential harvesting and launch more sophisticated campaigns. Google Threat Intelligence Group reports that financially motivated and espionage-focused attackers are increasingly turning to AI to target high-value sectors like healthcare, government, and media.
DIA Insider Pleads Guilty to Leaking Secrets to Foreign Spies
A DIA insider has pleaded guilty to leaking classified information to foreign spies, admitting to betraying his oath and putting national security at risk. The shocking case began with a single email in March 2025, sparking a months-long undercover operation that ultimately led to his arrest.
Signed Drivers Exposed to Abuse Microsoft Defender Driver Repurposed $10 Million Reward Offered AI Model Exploits Vulnerabilities RCE Flaws Discovered in Gogs, n8n
In a stunning example of old-school ingenuity, a team of investigators finally thwarted a sophisticated espionage campaign by doing something remarkably low-tech: cutting a cable to a compromised router in a Chicago data center. This bold move brought an end to months of digital detective work that had been stymied by the elusive threat actors.
China-linked SilkParasite campaign targets Central Asia with custom RATs
Meet SilkParasite, a sneaky espionage operation linked to China that's been targeting government bodies in Central Asia with a custom arsenal of Remote Access Tools. This sophisticated campaign boasts seven unique RAT families, five of which have never been seen before, and hints at AI-assisted development.
Jewelbug APT Exploits Dual Agenda with Espionage and Crypto Fraud
Meet Jewelbug, a notorious APT group that's been pulling off a double heist - stealing sensitive info and swindling victims out of crypto - all from the same interconnected operation. Their massive haul includes over 1 million implant check-ins and 580,000 stolen cookies, with targets spanning government systems and service providers across the Middle East, Southeast Asia, and South Asia.
Jewelbug Hacker Group Exposes Dual Threat of Espionage and Crypto Fraud
Meet Jewelbug, a China-based hacker group that's been wreaking havoc with a dual threat of espionage and crypto fraud, leaving a trail of over a million compromised implant check-ins and thousands of stolen credentials in its wake. By cleverly injecting a single malicious script into a shared webmail template, Jewelbug gained write access to sensitive government webmail accounts, making off with valuable data.
CAV3RN Espionage Framework Evolves With Google Apps Script C2 Relay
Meet the sneaky CAV3RN Espionage Framework, which just got a clever upgrade - it can now use Google Apps Script as a relay to secretly communicate with its controllers, all while hiding in plain sight within DNS traffic. This clever tactic lets the malware decide on a per-transaction basis whether to connect directly to its masters or take a detour through Google's services.
Kimsuky Bolsters Phishing Arsenal with Offline AI Infrastructure
North Korean hackers Kimsuky are taking phishing to the next level by leveraging offline AI infrastructure, a deliberate move to supercharge their espionage capabilities. Genians, a South Korean security firm, uncovered evidence of language-model tools like Ollama and GPT4All being installed and run on Kimsuky's servers.
Chinese Cyber-Attacks Expose Central Asian Governments to Espionage.
Since January 2025, a sneaky cyber-attack campaign has been targeting government organizations across Central Asia, with victims in six countries, including Afghanistan, Kazakhstan, and Uzbekistan. The attacks, involving customized malware, have hit a wide range of sectors, from healthcare and research to law enforcement and education.
Russia-Aligned TA488 Exploits Outlook Web Access With Persistent Implant
A Russia-aligned espionage group, known as TA488, has launched a sophisticated attack using a half-click backdoor, exploiting a flaw in Outlook Web Access to deploy a persistent implant. This new implant, dubbed OWAReaper, allows the group to maintain server-side access, marking a significant escalation in their cyber operations.