CyberCynical

New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillance on Android and iOS devices. "The developer runs dedicated channels for sales, customer support, and regular updates, giving buyers a single point of access to a fully operational spyware

New ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft

Cybersecurity researchers have disclosed details of a new mobile spyware platform dubbed ZeroDayRAT that's being advertised on Telegram as a way to grab sensitive data and facilitate real-time surveillanc…
#hackernews #news

Google: China's APT31 used Gemini to plan US cyberattacks : Meanwhile, IP-stealing 'distillation attacks' on the rise

遭制裁的中国政府背景黑客组织，被曝利用谷歌AI聊天机器人Gemini自动分析漏洞，并策划针对美国机构的网络攻击。
#网络安全威胁 #AI安全 #网络攻防

www.theregister.com/2026/02/12/g...

North Korean Hackers Use Deepfake Video Calls to Target Crypto Firms Campaign combines stolen Telegram accounts, fake Zoom calls and ClickFix attacks to deploy infostealer malware

North Korean Hackers Use Deepfake Video Calls to Target Crypto Firms #cybersecurity #infosec #hacking

www.infosecurity-magazine.com/news/north-k...

Chinese hackers reportedly penetrate UK Networks, putting millions at risk of eavesdropping, tracking Chinese state-linked hackers reportedly breached UK telecoms, including Downing Street, giving potential access to millions of calls and messages.

中国黑客据称在全球网络间谍行动中获得英国电信系统的完全访问权限
#中国 #黑客 #网络间谍行动 #网络安全
www.ibtimes.co.uk/chinese-hack...

The Many Arms of the MSS: Why Provincial Bureaus Matter in China’s Cyber Operations To defend systems, one must first pinpoint the source of malicious activity. Most cyber threat intelligence (CTI) firms focus on tactical and operational attribution: tactical attribution identifies a...

The Many Arms of the MSS: Why Provincial Bureaus Matter in China’s Cyber Operations malware.news/t/the-many-a...

#China #Chinese #MSS #provincial #cyber #hack #hacking #hacked

#中國 #中國人 #國家安全部 #省級 #網路 #駭客攻擊 #駭客入侵 #被駭

Chinese-Linked Badbox 2.0 Botnet Exposed with Ties to Kimwolf Malware Network The *Badbox 2.0* botnet, composed of Android TV boxes infected with preinstalled malware, is operated from China. Cybercriminals controlling the *Kimwolf* botnet (with over 2 million compromised devices) shared a screenshot suggesting access to *Badbox 2.0*'s control panel. The FBI and Google are investigating its operators. Several Chinese entities are mentioned, including *Beijing Astrolink Wireless Digital Technology Co. Ltd.*, *Beijing Hengchuang Vision Mobile Media Technology Co. Ltd.*, and email addresses linked to individuals such as *Chen Daihai* and *Zhu Zhiyu*. No specific date or detailed technical impact is provided.

📌 Chinese-Linked Badbox 2.0 Botnet Exposed with Ties to Kimwolf Malware Network https://www.cyberhub.blog/article/18645-chinese-linked-badbox-20-botnet-exposed-with-ties-to-kimwolf-malware-network

Notepad++ Hosting Breach Attributed to China-Linked Lotus Blossom Hacking Group Rapid7 links China-linked Lotus Blossom to a 2025 Notepad++ hosting breach that delivered the Chrysalis backdoor via hijacked updates, fixed in v8.8.9

与中国有关的黑客组织Lotus Blossom被归因于最近发现的托管Notepad++的基础设施遭到的破坏。
thehackernews.com/2026/02/note...

China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape Virtual Machines Researchers found Chinese-linked attackers abused SonicWall VPN access and VMware ESXi zero-day flaws to escape VMs and gain hypervisor control.

据信使用中文的威胁行为者利用一台已被攻破的 SonicWall VPN 设备作为初始入侵入口，随后部署了一种针对 VMware ESXi 的漏洞利用。该漏洞利用可能在其所依赖的三个安全漏洞被公开披露之前一年多就已被开发出来。
#中国 #漏洞利用 #网络安全 #威胁情报 #VMware #ESXi #VPN安全
thehackernews.com/2026/01/chin...

中国黑客组织 Salt Typhoon 被揭露入侵美国众议院工作人员的邮箱。这组织针对涉及中国、情报和军事委员会的工作人员展开网络间谍活动，窃取敏感信息。 #SaltTyphoon #中国 #网络间谍
www.technadu.com/chinese-hack...

Mustang Panda Uses Signed Kernel-Mode Rootkit to Load TONESHELL Backdoor Mustang Panda deployed TONESHELL via a signed kernel-mode rootkit, targeting Asian government networks and evading security tools.

HoneyMyte APT（又名Mustang Panda、Bronze President）使用内核态RootKit植入TONESHELL后门，攻击亚洲政府系统。
#中国 #恶意软件 #APT #MustangPanda #HoneyMyte

thehackernews.com/2025/12/must...

2 Chinese Hackers Trained in Cisco Program Now Leading Sophisticated Attacks on Cisco Devices

2 Chinese Hackers Trained in Cisco Program Now Leading Sophisticated Attacks on Cisco Devices

North Korean hackers exploit React2Shell flaw in EtherRAT malware attacks A new malware implant called EtherRAT, deployed in a recent React2Shell attack, runs five separate Linux persistence mechanisms and leverages Ethereum smart contracts for communication with the attacker. [...]

North Korean hackers exploit #React2Shell flaw in #EtherRAT #malware attacks

https://www.bleepingcomputer.com/news/security/north-korean-hackers-exploit-react2shell-flaw-in-etherrat-malware-attacks/

#NorthKorea #cybersecurity

CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems CISA details China-linked BRICKSTORM malware that enables persistent, stealthy access in VMware and Windows systems.

最近的CISA报告称，中国黑客又针对政府和IT行业，利用成为BRICKSTORM的后门程序以维持对受损系统的长期稳控。
thehackernews.com/2025/12/cisa...

Thor vs. Silver Fox – Uncovering and Defeating a Sophisticated ValleyRat Campaign - Nextron Systems Deep dive into the Silver Fox ValleyRat malware campaign, infection chain, driver abuse, and THOR’s detection capabilities.

Thor vs. Silver Fox – Uncovering and Defeating a Sophisticated ValleyRat Campaign | Nextron Systems analysis attributes the described operation to the China-aligned APT commonly referred to as Silver Fox | www.nextron-systems.com/2025/11/28/t...

PlushDaemon compromises network devices for adversary-in-the-middle attacks ESET researchers have discovered a network implant used by the China-aligned PlushDaemon APT group to perform adversary-in-the-middle attacks.

ESET researchers have discovered a network implant used by the China-aligned PlushDaemon APT group to perform adversary-in-the-middle attacks | www.welivesecurity.com/en/eset-rese... @esetofficial.bsky.social

朝鲜黑客组织Lazarus利用恶意软件ScoringMathTea攻击欧洲无人机制造商

#网络犯罪 #网络安全 #黑客 #朝鲜黑客 #朝鲜 #恶意软件 #网络攻击 #lazarus #DreamJob #网络钓鱼

North Korea led the world in nation-state hacking in Q2 and Q3 Security leaders should prioritize anomalous-activity detection and zero-trust principles, a new report recommends.

North Korea led the world in nation-state hacking in Q2 and Q3

#northkorea #hacking #cybersecurity #cyberthreat

www.cybersecuritydive.com/news/north-k...

Chinese Threat Group 'Jewelbug' Quietly Infiltrated Russian IT Network for Months Chinese group Jewelbug hacked a Russian IT provider, exploiting Microsoft tools and exfiltrating data via Yandex Cloud.

一名与中国有关联的威胁组织被指控对一家俄罗斯IT服务提供商发动了长达五个月的入侵行动，标志着该黑客组织的攻击范围已从东南亚和南美洲扩展至俄罗斯
#中国 #威胁组织 #俄罗斯 #入侵行动 #jewelbug

thehackernews.com/2025/10/chin...

China-linked groups are using stealthy malware to hack software suppliers Google, which disclosed the campaign, said it was one of the most significant supply-chain hacks in recent memory.

与中国有联系的团体部署隐形恶意软件来渗透软件供应商系统

#中国 #恶意软件 #网络安全 #UNC5221

www.cybersecuritydive.com/news/china-e...

China-Linked PlugX and Bookworm Malware Attacks Target Asian Telecom and ASEAN Networks PlugX and Bookworm campaigns strike Asian telecom and ASEAN targets using DLL side-loading and modular RATs.

中国黑客正利用PlugX的新变种，攻击亚太地区电信和制造业 #中国 #APT #恶意软件 #PlugX thehackernews.com/2025/09/chin...

中国黑客组织RedNovember利用Pantegana和Cobalt Strike恶意软件攻击全球政府
#中国 #中国黑客 #恶意软件 #网络安全 #CobaltStrike #Pantegana

中国的一个高级持续性威胁（APT）组织利用一种名为 EggStreme 的新型无文件恶意软件框架，成功入侵了菲律宾的一家军事企业。
#china #中国 #恶意软件 #APT

GhostRedirector: Chinese hackers plague Windows servers ESET Research has discovered a new Chinese hacker group. The group, dubbed “GhostRedirector,” has already compromised 65 Windows servers ...

#Security #Backdoor #China #cybersecurity #Eset #Hackers #malware #windows

Origin | Interest | Match

Czech cyber agency warns against using services and products that send data to China

朝鲜的 Lazarus 黑客组织通过伪造网站和冒充 Telegram 身份，攻击去中心化金融（DeFi）公司，并部署高级恶意软件进行间谍活动和窃取信息。 #间谍活动 #恶意软件 #窃取信息 #朝鲜

North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker Scheme Hits 320+ Firms

North Korea Uses GitHub in Diplomat Cyber Attacks as IT Worker Scheme Hits 320+ Firms

Taiwan Web Servers Breached by UAT-7237 Using Customized Open-Source Hacking Tools UAT-7237 exploits unpatched Taiwan servers using SoundBill, Cobalt Strike, and SoftEther VPN for persistent control.

网络安全研究员发现，与中国关联的APT组织UAT-7237正通过定制开源工具攻击台湾网络基础设施，试图对高价值目标实现持久化控制。#APT #中国 #台湾
thehackernews.com/2025/08/taiw...