#China
All CosmicBytez Labs articles tagged #China, across news, security advisories, how-to guides, and projects.
- News
China-Linked Hackers Exploited BeyondTrust Remote Support Zero-Day Since August
Armory Castle exploited CVE-2026-102764 (CVSS 9.3) in BeyondTrust Remote Support since late August, gaining root access and deploying webshells.
- News
FBI Seizes Seven Domains, Disrupts Flax Typhoon's MicroScan and FishHub Hacking Tools
FBI and DOJ seized seven domains used by China's Flax Typhoon to run MicroScan and FishHub, tools tied to critical infrastructure intrusions worldwide.
- News
FBI Seizes Seven Domains Behind Flax Typhoon's MicroScan and FishHub Hacking Tools
The FBI seized seven domains used by China-linked Flax Typhoon to run MicroScan and FishHub, tools tied to breaches of global critical infrastructure.
- News
FBI, Allies Expose China-Linked Flax Typhoon Portal Selling Stolen Email Access
FBI and 6 allied nations say China's Integrity Tech ran a portal selling access to emails stolen from Southeast Asian governments and healthcare systems.
- News
US Posts $10 Million Reward for Accused Chinese 'Hafnium' Hacker
State Dept. offers $10M for Zhang Yu, accused in the HAFNIUM Exchange Server campaign that hit 60,000+ US entities.
- News
Former NSA Chief Nakasone Says Agency Overhaul Is 'Probably Needed'
Paul Nakasone backs NSA's reported five-center reorg to counter faster AI-driven threats, but warns an aging workforce could undercut execution.
- News
China-Aligned TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
China-aligned TA419 impersonated ex-White House officials and an Anthropic staffer to phish AI policy experts via a Microsoft OAuth AitM kit.
- News
MI5 Says China's MSS Funded Research Involving 100+ U.K.-Linked Academics
MI5's Sept. 30 Espionage Alert says China's MSS funded AI, cyber, and covert-comms research via front company CGTRI, reaching 100+ U.K. academics.
- News
Warlock Exploits SharePoint Flaws to Disable Security Tools and Deploy Ransomware
China-nexus group Longlegs is still abusing SharePoint ToolShell flaws and a BYOVD EDR killer to deploy Warlock ransomware on critical infrastructure.
- News
Warlock Ransomware Breaches Water Utility, Telecom via SharePoint Flaws
New forensic detail reveals a 9-day Warlock ransomware intrusion chain that hit a water utility, telecom operator, government body, and university.
- News
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
China-nexus actor Longlegs (Storm-2603) hit a water utility, telecom, government body, and university in Iberia and Latin America via SharePoint flaws.
- News
China and US Agree to Establish AI Safety Channel, Continue Trade and Military Talks
After a three-day Trump-Xi summit, the US and China agreed to a new AI incident channel, military crisis talks, and a two-month trade truce extension.
- News
Lawmakers Introduce Bill for Voluntary Telecom Cyber Rules After Salt Typhoon Hacks
Sens. Mark Warner and Ted Cruz introduced a bill creating a voluntary, NTIA-led telecom cybersecurity framework in response to the Salt Typhoon hacks.
- News
Bipartisan Senate Bill Targets Telecom Cybersecurity After Salt Typhoon
Sens. Mark Warner and Ted Cruz introduced a bipartisan bill creating an NTIA-led telecom cybersecurity working group in response to Salt Typhoon.
- News
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
China-linked UTA0565 chained Chrome and Windows zero-days via spoofed websites to deploy the new CLEANGULP backdoor against Asian targets.
- News
No Evidence of Successful Foreign Meddling in 2024 Election, Spy Agencies Found
A classified U.S. intelligence assessment found no evidence Russia, China, or Iran altered the 2024 election's outcome, despite active influence campaigns.
- News
Chinese Hackers Exploit WordPress, Zyxel Flaws to Steal Government Data
Chinese-speaking actor breached 996 Zyxel switches and 49 orgs via WordPress flaws, stealing 18,566 government records.
- News
China's FamousSparrow APT Deploys New SparroWocky Backdoor Across Latin America
ESET says China-aligned FamousSparrow deployed a new SparroWocky backdoor against Latin American governments across eight countries.
- News
China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE
UTA0560 chained 3 Chrome and Windows zero-days in a phishing campaign against NGOs, deploying the GRIMWEDGE backdoor via a hijacked university site.
- News
Beijing Hits Back at Anthropic CEO's Call to Curb China's AI Development
China's Foreign Ministry rebuffed Dario Amodei's essay urging AI 'pacing' and continued chip export curbs, calling instead for cooperation over confrontation.
- News
Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries
China-linked actor Red Heron weaponized Gitea RCE CVE-2026-60004 within days, breaching 13 orgs across six countries with a custom implant.
- News
Hackers Exploit Tencent Sogou Input Method Flaw to Deploy GrayRabbit
A China-aligned group chains a Sogou Input Method URI flaw with an outdated Chromium engine for one-click RCE, deploying the GrayRabbit backdoor.
- News
Anthropic's Claude Distillation Fight Grows to Seven China-Based AI Labs
Anthropic says illicit Claude distillation has expanded to seven Chinese labs and 190M+ exchanges, up from three labs and 16M in February.
- News
China-Linked UNC3569 Exploits Sogou Input Method Flaw to Deploy GrayRabbit
A patched Sogou Input Method flaw let UNC3569 chain a URI handler bug into an unsandboxed Chromium webview to drop the GrayRabbit backdoor.
- News
Hackers Abused Claude to Extract Secrets From 1.8 Million Android Apps
Anthropic disrupted a ShinyHunters affiliate that used Claude to scan 1.8M Android APKs for hardcoded secrets, plus Russia- and China-linked hacking ops.
- News
In Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings Review
Roundup: novel InjectEave EM eavesdropping, an AT&T insider's SIM-swap sentencing, a Glasswing audit, and a $10M bounty on an Iranian cyber chief.
- News
DoJ Corrects China Hacking Claim: Agencies Were Targets, Not Victims
The DoJ walked back a claim that NASA, the Fed, and other agencies were breach "victims," clarifying they were targets of China-linked group QTFY.
- News
UAT-10147 Uses AI to Scale Server Attacks, Deploys SPECTRE With EDR Bypass and Linux Rootkit
UAT-10147 uses agentic AI to automate attacks on 170,000 web servers, deploying SPECTRE with BYOVD EDR bypass and an AI-assisted Linux kernel rootkit.
- News
Hackers Breach Govt Webmail While Running Parallel Crypto Fraud
China-linked Jewelbug injected malicious JS into 15 govt webmail tenants while simultaneously operating a 44-server industrial crypto fraud empire.
- News
China-Linked Storm-1175 Deploys StormEncryptor Ransomware via Critical N-central Flaw
Microsoft tracks Storm-1175 pivoting from Medusa ransomware to a new strain — StormEncryptor — exploiting an N-able N-central authentication bypass that...
- News
China-Linked Storm-1175 Turns N-able N-central Into MSP Ransomware Launchpad
Microsoft warns that the China-linked threat actor Storm-1175 is exploiting a critical zero-day in N-able N-central (CVE-2026-18577) to gain god-mode...
- News
Chinese Actor Weaponizes DeepSeek AI Agent to Attack Security Firm
Palo Alto Networks' Unit 42 documented the first confirmed autonomous AI-driven cyberattack campaign in the wild. A Chinese-speaking threat actor wired...
- News
Chinese Hacker Uses DeepSeek via Telegram to Launch Fully Autonomous Cyberattacks
Palo Alto Networks' Unit 42 documented a Chinese-speaking threat actor using the open-source Hermes Agent framework to direct DeepSeek AI through...
- News
Chinese Threat Actor Uses DeepSeek and Hermes Agent to Launch Fully Autonomous Cyberattacks
Palo Alto Networks Unit 42 exposes a Chinese-speaking threat actor who directed an AI agent via a single Telegram message, letting DeepSeek autonomously...
- News
Hacker Uses DeepSeek AI to Autonomously Attack Vulnerable Servers
Palo Alto Networks Unit 42 documents a Chinese-speaking threat actor who used DeepSeek and the open-source Hermes Agent framework to conduct autonomous...
- News
GoldenEyeDog Subgroup Linked to DigiCert Breach and Code-Signing Certificate Theft
Cybersecurity researchers at Expel have attributed the April 2026 DigiCert security incident to CylindricalCanine, a sub-group of the Chinese APT known as...
- News
China and India-Linked Hackers Both Targeted the Same Pakistani Police Force
SentinelOne researchers discovered that threat actors linked to both China and India independently targeted the Balochistan Police force in Pakistan for...
- News
Hackers Weaponize Balochistan Police Portal in Multi-Group Espionage Campaigns
SentinelOne researchers have uncovered two years of sustained cyberespionage against Pakistani law enforcement — with China-nexus and India-nexus threat...
- News
China and India Ran Separate Spying Campaigns Against the Same Pakistani Police Force
SentinelOne Labs uncovered parallel nation-state espionage operations by China-linked and India-linked threat actors targeting Pakistani law enforcement,...
- News
China-Linked UAT-7810 Expands ORB Network With New LONGLEASH Malware
Cisco Talos researchers have identified new LONGLEASH malware deployed by Chinese APT group UAT-7810 to expand its Operational Relay Box network,...
- News
Chinese LLMs Broaden the Gap Between Attackers & Defenders
China's GLM 5.2 finds vulnerabilities at $0.17 each and outperforms frontier Western models on security benchmarks — while AI-enabled adversary activity...
- News
Iran, Russia, and China Target Water Systems for Sabotage
Nation-state attackers from Iran, Russia, and China are breaching water utility systems through weak passwords, exposed PLCs, and poor network...
- News
In Other News: Chinese Mythos-Like AI, Tata Electronics Breach, Snyk Layoffs
Qihoo 360 unveils Tulongfeng — a Chinese rival to Anthropic's Mythos AI vulnerability finder; the World Leaks ransomware group dumps 630 GB from Tata...
- News
Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
A Chinese-speaking advanced persistent threat actor has launched targeted attacks against government entities and critical infrastructure in Southeast...
- News
China-Nexus Actor Spies on US Researchers Undetected for a Year
Google's Threat Intelligence Group discovered and disrupted a sprawling China-nexus espionage campaign that stole RedCAP credentials to silently breach...
- News
Google Exposes China Espionage Group UNC6508 Lurking in Networks Since 2023
Google's Threat Intelligence Group has unmasked UNC6508, a China-linked espionage actor that silently maintained access to critical infrastructure and...
- News
Chinese Hackers Breach REDCap Servers, Steal Medical Research Data
A China-linked espionage campaign targeted exposed REDCap servers, deploying the InfiniteRed malware to steal sensitive medical research data from a North...
- News
FBI Dismantles Massive AI-Powered Chinese Phishing-as-a-Service Operation
The FBI, Google, and Black Lotus Labs jointly dismantled Outsider Enterprise, a massive Chinese phishing-as-a-service platform that operated over one...
- News
China-Linked Hackers Backdoored Linux Login Software to Hide for Nearly a Decade
Sygnia researchers uncovered Velvet Ant, a China-nexus APT that spent close to a decade hidden inside Linux authentication infrastructure by backdooring...
- News
Chinese Hackers Hijack Auth Flow, Spy on Isolated Network for a Decade
Chinese state-sponsored hackers seized complete control of a target organization's authentication infrastructure and maintained undetected access for ten...
- News
Chinese APT UNC5221 Deploys Three New Malware Families to Maintain M365 Access
Chinese espionage group UNC5221 is actively using the Brickstorm backdoor alongside two newly discovered malware families — Plenet and AgentPSD — to maintain…
- News
China-Aligned Groups Ramp Up Attacks: Operation Dragon Weave Hits Czech Republic and Taiwan
Security researchers at Seqrite Labs have uncovered Operation Dragon Weave, a new China-aligned cyber espionage campaign targeting government, research…
- News
Chinese-Speaking Fraud Gang Targets 2026 World Cup Fans with 4,300 Fake FIFA Domains
A Chinese-speaking cybercriminal group has registered over 4,300 fraudulent domains impersonating FIFA's official web presence since August 2025,...
- News
China's 'FamousSparrow' APT Nests in South Caucasus Energy
The China-linked threat group FamousSparrow has expanded its targeting to an Azerbaijani oil and gas company, marking a shift beyond its traditional...
- News
US & China Partner on Scam Center Takedown in Dubai
In a rare show of bilateral cooperation, the US Justice Department and Chinese authorities jointly dismantled a major cryptocurrency investment fraud scam...
- News
China-Linked GopherWhisper Infects 12 Mongolian Government
A previously undocumented China-aligned APT group tracked as GopherWhisper has targeted Mongolian governmental institutions, deploying a wide array of...
- News
China-Linked APT GopherWhisper Abuses Legitimate Services
A newly identified Chinese advanced persistent threat group dubbed GopherWhisper has been deploying multiple Go-based backdoors alongside custom loaders...
- News
Tropic Trooper Uses Trojanized SumatraPDF and GitHub to Deploy AdaptixC2
Zscaler ThreatLabz has uncovered a Tropic Trooper (APT23) campaign that delivers the AdaptixC2 post-exploitation beacon via trojanized SumatraPDF...
- News
In Other News: Cyberattack Stings Stryker, Windows
A weekly roundup of notable cybersecurity stories: Iran-linked hackers wipe 200,000 Stryker devices, the BlueHammer Windows zero-day PoC goes public,...
- News
China-Linked Storm-1175 Chains Zero-Days for High-Velocity
A China-based threat cluster designated Storm-1175 has been linked to high-velocity ransomware attacks deploying Medusa payloads using chained zero-day...
- News
Storm-1175 Deploys Medusa Ransomware at 'High Velocity'
Microsoft says the financially motivated cybercrime group Storm-1175, linked to China, has exploited N-day and zero-day vulnerabilities in high-velocity...
- News
Microsoft Links Storm-1175 to Medusa Ransomware Zero-Day
Microsoft has formally attributed Medusa ransomware zero-day attacks to Storm-1175, a China-based financially motivated cybercriminal group that has...
- News
Three China-Linked Clusters Target Southeast Asian
Three threat activity clusters aligned with China jointly targeted a Southeast Asian government organization in a complex, well-resourced espionage...
- News
OpenClaw AI Agent Flaws Enable Prompt Injection, 1-Click
China's CNCERT has warned that OpenClaw (formerly Clawdbot/Moltbot), the viral self-hosted AI agent, carries over 250 disclosed vulnerabilities including...
- News
Google: 90 Zero-Days Exploited in 2025 — Enterprise Tech
Google's Threat Intelligence Group tracked 90 zero-day vulnerabilities actively exploited in 2025, with enterprise software and appliances accounting for...
- News
Google Disrupts Massive Chinese Espionage Campaign
Google's Threat Intelligence Group dismantles UNC2814, a China-linked operation that deployed a novel backdoor called GRIDTIDE abusing Google Sheets API...
- News
Leaked Documents Reveal China's 'Expedition Cloud' Cyber
Technical documents leaked from a malware-infected developer device expose a Chinese military-linked training platform that replicates the critical...
- News
Anthropic Exposes Industrial-Scale AI Distillation Attacks
Anthropic revealed that three Chinese AI companies — DeepSeek, Moonshot AI, and MiniMax — orchestrated industrial-scale distillation campaigns using...
- News
Notepad++ Supply Chain Attack Attributed to China-Linked
Notepad++ releases emergency v8.9.2 patch after a China-linked APT group hijacked the update mechanism for six months, deploying the Chrysalis backdoor to...
- Security
Dell RecoverPoint Zero-Day Exploited by Chinese APT Since
A maximum-severity CVSS 10.0 hardcoded credentials vulnerability in Dell RecoverPoint for VMs has been under active exploitation by China-nexus threat...
- News
Alibaba Launches Qwen 3.5 — Claims to Outperform GPT-5.2
Alibaba Cloud unveils Qwen 3.5, a 397-billion-parameter Mixture-of-Experts AI model with native multimodal capabilities, claiming 60% lower costs and...
- News
All Four Major Nation-State Adversaries Now Weaponizing
Google reports that APT groups from China, Russia, Iran, and North Korea are all actively using Gemini AI for cyber operations including target...
- News
China-Linked UNC3886 Breaches All Four Singapore Telecom
Singapore discloses that APT group UNC3886 compromised all four major telecom providers using zero-day exploits and rootkits, triggering the nation's...
- Security
Lotus Blossom APT Compromises Notepad++ Updates to Deploy
China-linked Lotus Blossom hijacked Notepad++ software updates for six months, selectively delivering the Chrysalis backdoor to government and IT targets...
- Security
UNC3886 Zero-Day Campaign: Singapore Telecom Operators
Singapore discloses that APT group UNC3886 conducted a targeted espionage campaign against M1, SIMBA, Singtel, and StarHub using a previously unknown...
- Security
WinRAR Path Traversal Flaw CVE-2025-8088 Actively Exploited
Critical path traversal vulnerability in WinRAR enables ransomware and credential theft as Russian and Chinese threat actors weaponize phishing campaigns...
- News
Senator Demands AT&T, Verizon CEOs Testify Over Salt
Senate Commerce Committee Chair Maria Cantwell accuses AT&T and Verizon of blocking Mandiant security reports related to the Salt Typhoon campaign,...
- Security
China-Linked Hackers Exploit VMware ESXi Zero-Days to Escape VMs
Sophisticated attack chain leverages compromised SonicWall VPN and VMware ESXi vulnerabilities to break out of virtual machine isolation and compromise...