Tag: nation state
1333 articles
Google Warns of China Espionage Actor Exploiting BeyondTrust Flaw
Google warns that a suspected China state-sponsored espionage actor, known as Armory Castle, has been actively exploiting a critical BeyondTrust Remote Support vulnerability, rated 9.3 on the CVSS scale, since August 2026. This group has a history of long-term intelligence collection for the People’s Republic of China, targeting industries from legal services to government agencies.
China-Linked Hackers Exploit BeyondTrust Zero-Day to Breach Remote Support Servers
A high-severity flaw in BeyondTrust Remote Support was exploited as a zero-day by a China-linked group, allowing them to take control of at least one self-hosted remote support appliance. The vulnerability, rated CVSS 9.3, was swiftly patched by BeyondTrust for SaaS customers, with self-hosted customers receiving manual update instructions.
BAE Systems Cyber Incident Paralyzes US Bankruptcy Noticing System
A major cyber incident has crippled the US Bankruptcy Noticing System, leaving thousands of courts nationwide without access to critical bankruptcy notices. The disruption, caused by a BAE Systems cyber incident, has brought the system to a standstill, with officials working to restore access as soon as possible.
North Korea's Hero Kim Kun Ok Submarine Conducts Missile Tests at Sea
North Korea's latest at-sea missile tests are a bold statement of its military ambitions, with leader Kim Jong Un vowing to arm the Navy with nuclear weapons as soon as possible. The tests, conducted by the Hero Kim Kun Ok submarine, showcased Pyongyang's growing underwater combat capabilities.
Hackers Exploit Vulnerable Fridge Software in France
The unsettling truth about IoT devices: if they can't be updated, they're vulnerable, and even if they can be updated, they're still at risk. In a chilling example, hackers recently took control of French refrigerators, manipulating temperatures to scorching highs of 50°C (120°F) and wreaking havoc on supermarket chains.
China Expands Policing Footprint in Africa with Organised Crime
China is taking its unique policing model to Africa, exporting a system that prioritizes the Communist Party's interests over citizens' rights and independent oversight. This approach, which emphasizes surveillance and pre-emptive intervention, could have far-reaching implications for partner countries.
AI-Powered Attacks Target Government Linux Infrastructure
Meet CL-UNK-1211, a sneaky AI-powered espionage campaign that infiltrated government entities and state-affiliated infrastructure between October 2025 and April 2026. The attackers cleverly embedded AI into their workflow, using conversational annotations and step-by-step notes that hinted at automated code generation.
BAE Systems Cyberattack Cripples US Bankruptcy Court Notices
A cyberattack on BAE Systems has crippled the US bankruptcy court's notice system, leaving thousands of federal bankruptcy notices in limbo. The Administrative Office of the US Courts is working closely with BAE to investigate and restore operations as soon as possible.
Fortinet Flaw Exploited to Deploy PEERSTITCH Malware
Hackers exploited a critical Fortinet flaw to breach a telecom provider's system, harvesting sensitive data from over 500 firewalls to deploy a sneaky, hard-to-detect malware implant. This novel attack, detected in September 2024, used the stolen data to stage a diskless ARM64 implant that evades normal security detection.
Unit 42 Exposes PEERSTITCH, Novel FortiGate Implant
In a shocking discovery, Unit 42 uncovered PEERSTITCH, a novel FortiGate implant used by attackers to exfiltrate sensitive data from over 500 firewalls, all originating from a single compromised appliance. The breach began with a clever exploitation of a previously unknown vulnerability, CVE-2024-47575, in FortiManager's FMG-Access channel.
Foreign Actors Exploit AI Chatbots in U.S. Election Influence Campaigns
In a shocking display of election meddling, a network of hyperlocal websites sprouted up across 14 states, spreading influence and propaganda in a remarkably coordinated effort. These sites, registered in a matter of minutes, seemed designed to sound local but were actually part of a large-scale operation to sway US voters.
Silent Lynx Exploits WinRAR Flaw in CIS Government Cyberattacks
Meet Silent Lynx, a stealthy cyber threat actor wreaking havoc in Central Asia and beyond, exploiting a WinRAR flaw to launch targeted attacks on government agencies and embassies across nine countries in the CIS region. Their campaign, tracked from January 2025 to May 2026, has left a trail of breaches in its wake.
Citizen Lab Exposes Candiru Spyware Infections Through Targeted Online Ads
Meet the sneaky spyware that can infect your device with just a single online ad - no clicks required. Citizen Lab researchers uncovered a cunning ad-delivery chain used by Discover-Tech to spread zero-click spyware, infecting targets with alarming precision.
Healthcare Ransomware Attacks Surge, Exposing Sector's Vulnerabilities
Healthcare organizations are being hit with a staggering 3.33 ransomware attacks per day, making them a treasure trove for hackers seeking sensitive information and massive payouts. This surge in attacks highlights the sector's alarming vulnerability to cyber threats.
Danfoss Controllers Disappear After Cyber-Attack
A massive 71% of internet-exposed Danfoss StoreView control panels in France vanished within just three days following a cyber-attack that crippled hundreds of supermarkets, suggesting a frantic effort to pull systems offline rather than fix them. This sudden disappearance was tracked by Censys researchers, who monitored the dramatic decline from 1,825 exposed hosts on October 11 to just 537 by October 14.
X Disrupts 13,000 Accounts Tied to Foreign Influence Ops Ahead of US Midterms
In a major move to safeguard the US midterm elections, X has proactively removed over 13,000 accounts linked to foreign influence operations from Iran, Russia, and China. These accounts were using fake identities to spread and amplify divisive political content targeting candidates and public figures.
Fake AI Attacks Target US Companies via Impersonated Brands
US companies are under attack by fake AI campaigns that impersonate trusted brands like Claude, ChatGPT, and Copilot, spreading malware and stealing sensitive data. Attackers are using clever tactics, such as sponsored search results and fake download websites, to trick victims into compromising their business accounts.
Microsoft Disrupts Global Phishing Network Behind 1 Billion Messages
Microsoft and Japanese police have joined forces to take down a notorious phishing network, known as Yam Store or Storm-3119, that was responsible for a staggering 1 billion phishing emails and texts sent to over 75,000 organizations since January 2026. This underground marketplace was selling compromised accounts, licenses, and storage to threat actors, fueling a massive wave of cyber scams.
US Charges 14 in North Korean Remote Work Scheme Crackdown
The US Justice Department has cracked down on a massive remote-work scheme benefiting North Korea, charging 14 people and seizing nearly 200 computers in a nationwide operation. This sweeping move, dubbed Operation Lonestar Roundup, goes far beyond fraud, aiming to dismantle a sprawling network of "laptop farms" used to allegedly funnel profits to the reclusive regime.
Microsoft Disrupts Vast Chinese-Language Phishing Kit Network
Microsoft swooped in to dismantle a massive Chinese-language phishing kit network that had been bombarding over 75,000 organizations worldwide with a staggering 1 billion+ emails and SMS messages since January. The campaigns, tracked as Storm-2990, were fueled by a commercial ecosystem of customizable phishing kits.
US Weakens Foreign Influence Tracking Ahead of Midterms
As the midterm elections approach, the US is scaling back its efforts to track foreign influence, despite assurances that election security remains a top priority. The Cybersecurity and Infrastructure Security Agency will still work closely with partners to monitor threats, but several officials say federal relationships crucial to detecting foreign campaigns are dwindling.
FBI Disrupts North Korean IT Worker Schemes, Arrests US Nationals
In a major crackdown, the FBI swooped in on a North Korean remote IT worker network in Texas, seizing nearly 187 laptops in a multi-day operation dubbed the "Lonestar Roundup." This bold move marks the beginning of a broader effort to dismantle the notorious Famous Chollima threat group's US infrastructure.
China Learns from Russia's Ukraine War Experience
China sent a team to Russia's massive Tsentr military exercise, where troops from over 30 countries practiced tactics learned from the Ukraine conflict on a mock battlefield. The drills, involving 47,000 personnel and 600 aerial drones, gave China valuable insight into Russia's wartime strategies.
Forescout Researchers Expose ROMULUS Malware Server Leveraging ClickFix
Forescout researchers have uncovered a cunning malware server, dubbed ROMULUS, that's linked to a notorious campaign called ClickFix, and what's alarming is that it can deliver multiple payloads. This discovery was made by Vedere Labs, part of Forescout Research, who identified six servers running the ROMULUS platform.