Threats Affecting China

BambooToken is an emerging multiplatform malware family active since at least February 2023, utilizing the Message Queueing and Telemetry Transport (MQTT) protocol for covert command and control operations. The campaign targets Windows and Linux systems across Asia and South America, with infections observed on backend servers for mobile applications, legal and financial services, software companies, hotels, and GitLab instances. The malware leverages sideloading techniques through Tendyron's OnKey authentication software, commonly used in Chinese banking and government networks. Analysis reveals extensive host enumeration capabilities, plugins for antivirus detection, and potential keylogging and clipboard theft functions. Infrastructure analysis shows C2 domains ranking in Cloudflare's top 500,000, indicating widespread infections. The actor demonstrates sophisticated operational security, using MQTT's publish-subscribe architecture to hide infrastructure and employing Cloudflare proxies for additional o...

MediumMalwareArgentinaCambodiaChile+6#supply chain#mqtt#iocontrol

An active malware campaign utilizes fraudulent software-download websites impersonating trusted vendors to distribute malicious installers. The operation primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The malicious installers deploy malware capable of establishing persistence, disabling Windows Update services, configuring Microsoft Defender exclusions, deleting volume shadow copies, and establishing command-and-control communications. Microsoft attributes this activity with moderate confidence to the Chinese threat cluster Silver Fox, known for using spoofed vendor download pages to distribute remote access trojans. The campaign leverages high-fidelity clones of legitimate vendor websites hosted on Chinese domains, delivering server-side generated payloads through ZIP archives.

MediumMalwareChina#dll sideloading#silver fox trojan#fake installers

A malware campaign uses counterfeit software-download websites impersonating trusted vendors to distribute malicious installers. The activity primarily targets China-based operations of multinational organizations and Chinese-speaking users across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. Malicious installers deploy payloads that establish persistence, disable security protections, and communicate with attacker-controlled infrastructure. The campaign employs dynamically generated installers with rotating hashes, spoofed vendor pages on .com.cn and .hl.cn domains, and randomized payload staging paths. Follow-on activity includes disabling Windows Defender, deleting shadow copies, neutralizing Windows Update, creating scheduled tasks for persistence, and establishing command-and-control over non-standard ports. Microsoft assesses this activity aligns with publicly reported Silver Fox operations but has not attributed it to a nation-state actor.

MediumCampaignChina#scheduled tasks#silver fox#counterfeit installers

ValleyRAT is a backdoor malware distributed disguised as legitimate Chinese adware called QN Wallpaper. It uses DLL sideloading to execute malicious code under a signed process. The malware includes capabilities such as keylogging, clipboard monitoring, screenshot capture, and module delivery. The campaign has impacted over 1,500 users mainly in China and India with over 100,000 detections in 2026. The Silver Fox threat group is attributed to this campaign. The malware disables Windows Defender, establishes persistence, and protects its processes by marking them critical to cause system crashes if terminated.

MediumMalwareBritish Indian Ocean TerritoryChinaIndia#qn wallpaper#valleyrat#adware disguise

A misconfigured open directory on IP 86.53.111.212:8080 exposed the Moobot botnet source code, DDoS tools, and fraudulent services linked to an active cybercrime operation. The exposed data included StresD Pro+, a multi-user DDoS panel with multiple registered accounts and recorded attacks. Analysis of the Moobot source code revealed a dormant download-and-execute feature likely used by APT28 to deploy malware. Despite a 2024 court-authorized disruption, Moobot remains active as of August 2026, with ongoing DDoS attacks consistent with DDoS-as-a-service activity.

MediumMalwareChina#ddos-as-a-service#botnet#iot security

Three implants named SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS have been found embedded in ZBT router firmware distributed globally, including in the US, Canada, Australia, Philippines, Germany, and Russia. DARKLANTERN is an unauthenticated UDP backdoor on port 9992 providing root shell access with trivial MAC address bypass. SPEAKINGSTONE is a phone-home implant capable of DNS hijacking, ISP credential theft, and remote command execution. These implants use plaintext protocols without authentication, making them vulnerable to hijacking by network adversaries. The compromised hardware is found in white-labeled consumer products sold through mainstream retailers, representing embedded surveillance capabilities in commercial devices. A sinkholed backup domain revealed 392 devices, mostly in China, and internet scans found 203 DARKLANTERN instances in 22 countries.

MediumMalwareUnited StatesAustraliaCanada+8#firmware implants#phone-home implant#darklantern

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18303.

HighVulnerabilityUnited StatesGermanyFrance+10#remote#rce#gcve

This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8. The following CVEs are assigned: CVE-2026-18309.

HighVulnerabilityUnited StatesGermanyFrance+11#remote#rce#gcve

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.

HighVulnerabilityUnited StatesChinaGermany+7#remote#rce#cve

Cisco Talos identified a Chinese-speaking cybercrime group, UAT-10147, conducting large-scale attacks against Windows and Linux web servers globally. The group exploits publicly disclosed vulnerabilities to gain initial access and integrates AI-driven tools to automate exploitation, reconnaissance, payload generation, validation, and persistence. Targets include organizations in government, education, media, technology, and gaming sectors across Brazil, Bolivia, China, Canada, and Vietnam. The actor deploys malware for SEO fraud and data theft, using multiple open-source offensive frameworks and privilege escalation tools. The infection chains involve multi-stage scripts that evade detection and establish persistence via backdoors and rogue accounts. Talos assesses this as a financially motivated campaign leveraging semi-autonomous AI orchestration to scale complex intrusions efficiently.

HighCampaignBrazilBoliviaChina+2#windows#linux#cisco