The ongoing conflict involving Iran has led to increased cyber espionage activities targeting Middle Eastern governments. Multiple state-sponsored threat actors, including those from China, Belarus, Pakistan, and Hamas, have been observed conducting campaigns using the conflict as a lure. These actors are employing various tactics such as credential phishing, malware delivery, and compromised accounts to target government and diplomatic organizations. The campaigns often use war-themed content to engage targets and gather intelligence on the conflict's trajectory and geopolitical implications. Iranian threat actors continue their traditional espionage efforts alongside disruptive campaigns in support of war efforts. This heightened activity reflects both opportunistic use of topical lures and shifts in intelligence collection priorities for various state-aligned groups.
UAT-9244, a China-nexus advanced persistent threat actor, has been targeting critical telecommunications infrastructure in South America since 2024. The group employs three new malware implants: TernDoor, a Windows-based backdoor variant of CrowDoor; PeerTime, an ELF-based backdoor using BitTorrent protocol; and BruteEntry, a brute force scanner for SSH, Postgres, and Tomcat servers. UAT-9244 uses dynamic-link library side-loading, scheduled tasks, and registry modifications for persistence. The group is closely associated with FamousSparrow and Tropic Trooper, sharing similar tooling and tactics. Their infrastructure includes multiple command and control servers and operational relay boxes for scanning and brute-forcing activities.
A global espionage campaign targeting telecommunications and government organizations across four continents has been disrupted. The threat actor, UNC2814, is suspected to be linked to China and has been active since 2017. The campaign utilized a sophisticated backdoor called GRIDTIDE, which leveraged Google Sheets API for command and control. The attackers compromised 53 victims in 42 countries, with suspected infections in 20 more. GRIDTIDE's capabilities include executing shell commands, file transfers, and evading detection by disguising traffic as legitimate cloud API requests. The disruption involved terminating attacker-controlled cloud projects, disabling infrastructure, and revoking API access.
The UNC2814 threat actor, active since at least 2017, has been conducting a Chinese cyberespionage campaign targeting telecommunications companies and government organizations across 42 countries. Google recently disrupted this campaign, which focused on espionage activities rather than destructive attacks. The threat actor's operations involve sophisticated techniques to infiltrate and maintain persistence within targeted networks. Although no specific vulnerabilities or exploits have been publicly disclosed, the campaign's longevity and broad geographic scope highlight its strategic nature. The medium severity rating reflects the espionage focus, limited public exploit details, and absence of widespread destructive impact. Organizations in telecommunications and government sectors worldwide should remain vigilant against such advanced persistent threats. Mitigation requires enhanced threat detection, network segmentation, and intelligence sharing. Countries with significant telecom infrastructure and geopolitical interest in China are at higher risk. Overall, this campaign underscores the ongoing cyberespionage risks posed by state-sponsored actors targeting critical sectors globally.
An analysis of Chinese hosting environments identified over 18,000 active malware command-and-control (C2) servers distributed across 48 infrastructure providers, with China Unicom hosting nearly half. The majority of malicious activity is C2 infrastructure (84%), followed by phishing (13%). Key malware families such as Mozi, ARL, and Cobalt Strike dominate C2 activity, supporting both cybercrime and state-linked operations. High-trust networks like China169 Backbone and CERNET are exploited, revealing persistent abuse patterns and infrastructure reuse across campaigns.
UAT-7290, a sophisticated threat actor active since 2022, is targeting critical infrastructure entities in South Asia, particularly telecommunications providers. The group's arsenal includes malware families like RushDrop, DriveSwitch, SilentRaid, and Bulbature. UAT-7290 conducts extensive reconnaissance before intrusions, using one-day exploits and SSH brute force to compromise edge devices. The actor is believed to be a China-nexus APT, sharing similarities with APT10 and other known Chinese threat groups. UAT-7290 has recently expanded its targeting to Southeastern Europe and may establish Operational Relay Boxes for other China-nexus actors. Their malware suite primarily focuses on Linux systems but can also utilize Windows-based implants.
A sophisticated phishing campaign impersonating the Indian Income Tax Department has been targeting local businesses. The attack begins with a spear-phishing email containing a PDF attachment that directs victims to a fake compliance portal. This triggers the download of a malicious ZIP file, which initiates a multi-stage infection chain. The payload, delivered through NSIS installers, deploys a Remote Access Trojan (RAT) with persistence capabilities. The malware harvests system information and establishes communication with command and control servers. Technical indicators suggest a China-linked development environment. This campaign demonstrates how seemingly simple tax-themed phishing can lead to complete device compromise, emphasizing the need for heightened security awareness.
The Chinese APT group Silver Fox has launched an SEO poisoning campaign targeting Chinese-speaking users, impersonating Microsoft Teams. The campaign uses a modified ValleyRAT loader with Cyrillic elements to mislead attribution. Silver Fox aims to conduct espionage and financial fraud, posing a significant threat due to its dual mission. The attack chain involves a fake Teams website, malicious ZIP files, and binary data retrieval from XML and JSON files. The malware exploits rundll32.exe for binary proxy execution and establishes C2 communication. Attribution to Silver Fox is based on overlapping infrastructure and links to previous campaigns. Organizations with global operations, especially in China, are advised to implement robust security measures and logging capabilities to defend against this evolving threat.
This report discusses concerns about Huawei and Chinese surveillance activities as highlighted by Bruce Schneier, a well-known security expert. It is a security news article rather than a direct vulnerability or exploit. The content focuses on geopolitical and supply chain risks related to Huawei's telecommunications equipment and potential surveillance implications. There are no specific technical vulnerabilities, exploits, or affected software versions detailed. The threat is medium severity due to the potential impact on confidentiality and national security, but lacks direct exploitability information. European organizations using Huawei infrastructure may face risks of unauthorized data access or espionage. Mitigation involves careful supply chain risk management, network segmentation, and enhanced monitoring of Huawei equipment. Countries with significant Huawei infrastructure deployment and geopolitical tensions with China, such as Germany, France, and the UK, are most likely affected. The threat is indirect, stemming from surveillance concerns rather than technical exploits, requiring strategic and policy-level responses.
China-aligned threat actor PlushDaemon has been conducting espionage operations since 2018, targeting entities in China, Taiwan, Hong Kong, Cambodia, South Korea, the United States, and New Zealand. The group employs a custom backdoor called SlowStepper and uses a network implant named EdgeStepper to hijack legitimate updates. EdgeStepper redirects DNS queries to a malicious node, rerouting traffic from legitimate infrastructure to attacker-controlled servers. The group has also exploited web server vulnerabilities and performed a supply-chain attack. PlushDaemon's adversary-in-the-middle technique involves compromising network devices, deploying EdgeStepper, and using it to redirect DNS queries for software updates to malicious nodes. This allows them to serve malicious updates containing the LittleDaemon downloader, which then deploys the SlowStepper implant.
A November 2025 Homeland Security brief highlights emerging cyber threats from state actors including China, Russia, Iran, and North Korea. Among these threats is a novel malware strain that uniquely interacts with large language models (LLMs). Although detailed technical specifics are limited, this represents an evolution in malware capabilities leveraging AI technologies. The threat is currently assessed as medium severity with no known exploits in the wild. European organizations could face risks related to data confidentiality and operational integrity, especially those integrating AI or LLM-based systems. Mitigation requires enhanced monitoring of AI-related endpoints, strict access controls, and collaboration with threat intelligence communities. Countries with significant AI adoption and strategic geopolitical relevance, such as Germany, France, and the UK, are more likely to be targeted. Given the novelty, ease of exploitation is uncertain but the potential impact on confidentiality and integrity justifies a medium severity rating. Defenders should prioritize awareness of AI-targeted malware and prepare incident response plans accordingly.
Australia’s spy chief has issued a critical warning regarding cyber threats linked to China targeting critical infrastructure. Although specific technical details or exploited vulnerabilities are not provided, the alert highlights the strategic targeting of vital systems that support national security and essential services. The threat underscores the increasing geopolitical tensions and the use of cyber operations as a tool for state-level influence and disruption. European organizations with critical infrastructure sectors similar to Australia's could face analogous risks, especially those involved in energy, transportation, and communications. The warning calls for heightened vigilance and proactive defense measures to mitigate potential espionage or sabotage attempts. No known exploits or patches are currently identified, indicating a focus on threat intelligence and preparedness rather than immediate incident response. Given the nature of critical infrastructure and the potential for widespread disruption, the severity is assessed as critical. Countries with significant critical infrastructure and geopolitical interest in countering Chinese cyber activities are most likely to be affected. Defenders should prioritize intelligence sharing, network segmentation, and advanced monitoring to detect and respond to sophisticated state-linked threats.
The Silent Lynx APT group has been conducting espionage campaigns targeting Central Asian nations, Russia, China, and Azerbaijan. Two main campaigns were identified: one focusing on Russia-Azerbaijan relations and another on China-Central Asia relations. The group uses various malware including PowerShell scripts, .NET implants, and C++ reverse shells. They leverage spear-phishing with malicious attachments, GitHub-hosted payloads, and scheduled tasks for persistence. The campaigns aim to gather intelligence on diplomatic communications, transportation projects, and other strategic initiatives. Silent Lynx shows a pattern of targeting summit meetings and infrastructure deals in the region, with a particular focus on events in Dushanbe, Tajikistan.
The Silent Lynx APT group has been conducting espionage campaigns targeting diplomatic entities and critical infrastructure in Central Asia, Russia, and China. Two major campaigns were identified: one focused on Russia-Azerbaijan relations and another on China-Central Asia relations. The group used various malware tools including PowerShell scripts, .NET implants, and C++ reverse shells. They leveraged spear-phishing emails with malicious attachments and GitHub-hosted payloads. Key targets included government think-tanks, diplomats, and entities in mining, transport and communication industries. The campaigns coincided with important summits and meetings between the targeted countries. Attribution was based on similarities in tactics, tools, and victimology to previous Silent Lynx operations.
CVE-2025-12357 is a medium-severity vulnerability in the ISO 15118-2 protocol used by electric vehicle (EV) chargers. It involves manipulation of the Signal Level Attenuation Characterization (SLAC) protocol via spoofed measurements, enabling a man-in-the-middle (MitM) attack between an EV and its charger. The attack can be conducted wirelessly within close proximity through electromagnetic induction, without requiring authentication or user interaction. This vulnerability impacts confidentiality, integrity, and availability of the charging communication, potentially allowing attackers to intercept or alter charging commands and data. No known exploits are currently in the wild, and no patches have been published yet. Organizations deploying ISO 15118-2 compliant EV chargers should prioritize mitigation to prevent unauthorized access and data manipulation. Countries with significant EV adoption and infrastructure, such as the United States, Germany, China, Japan, and others, are at higher risk. The vulnerability’s CVSS score is 6.3, reflecting medium severity due to its remote attack vector but limited scope and impact. Defenders should implement network segmentation, monitor for anomalous SLAC traffic, and apply vendor updates once available.
A critical Windows zero-day vulnerability is actively exploited by Chinese threat actors to conduct espionage targeting European diplomats. This zero-day allows attackers to compromise Windows systems without requiring user interaction or authentication, enabling stealthy surveillance operations. Although specific affected Windows versions are not detailed, the exploitation focuses on high-value diplomatic targets in Europe. No patches or CVEs have been released yet, and public technical details remain limited. The threat poses significant risks to confidentiality and integrity of sensitive diplomatic communications and data. European organizations, especially government and diplomatic entities, face heightened risk due to the strategic targeting by a nation-state actor. Immediate mitigation requires enhanced monitoring, network segmentation, and strict access controls. Countries with extensive diplomatic presence and geopolitical relevance to China are most likely affected. Given the critical impact and active exploitation, this zero-day vulnerability demands urgent attention and tailored defensive measures.
A major US telecom backbone provider, Ribbon Communications, was reportedly compromised by nation-state actors. Ribbon Communications supplies critical communications technology to the US government and major telecom operators. Although specific technical details of the breach are not disclosed, the attack likely targets sensitive infrastructure supporting telecom networks. The incident highlights risks to telecom supply chains and potential impacts on network confidentiality, integrity, and availability. No known exploits or patches have been reported yet. European organizations relying on interconnected telecom infrastructure or using Ribbon products may face indirect risks. Mitigation requires enhanced monitoring, supply chain risk assessments, and collaboration with vendors. Countries with significant telecom infrastructure linked to US networks or strategic geopolitical interest in US-China/Russia relations are more likely to be affected. Given the medium severity and lack of detailed exploit information, the threat is assessed as high due to the critical nature of telecom backbone systems and potential for disruption or espionage.
Salt Typhoon, a China-linked cyber espionage group, exploited a zero-day vulnerability (CVE-2024-40766) in Citrix NetScaler Gateway appliances to target a European telecommunications organization. The attackers used DLL sideloading to deploy the SNAPPYBEE backdoor and leveraged LightNode VPS endpoints for command and control. The intrusion involved lateral movement from the compromised gateway to Citrix VDA hosts with the intent of data exfiltration. Darktrace detected the attack early through anomaly-based detection, enabling containment before significant damage occurred. No known exploits are currently in the wild. The threat demonstrates sophisticated stealth techniques by state-sponsored actors targeting critical infrastructure. Organizations using Citrix infrastructure, especially in telecommunications, should monitor proactively and apply patches when available. The suggested severity is medium due to the targeted nature and exploitation complexity.
Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and military operations, with the objective of gathering sensitive information. Phantom Taurus employs distinctive tactics, techniques, and procedures, including a new malware suite called NET-STAR. This suite consists of three web-based backdoors designed to target Internet Information Services (IIS) web servers. The group has recently shifted from targeting emails to directly accessing databases, demonstrating their ability to adapt and evolve their methods. Phantom Taurus' activities align with Chinese strategic interests, and their infrastructure overlaps with other known Chinese APT groups.
Improper Handling of Length Parameter Inconsistency vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series Q03UDVCPU, Q04UDVCPU, Q06UDVCPU, Q13UDVCPU, Q26UDVCPU, Q04UDPVCPU, Q06UDPVCPU, Q13UDPVCPU, and Q26UDPVCPU with the first 5 digits of serial No. "24082" to "27081" allows a remote attacker to cause an integer underflow by sending specially crafted packets to the affected product to stop Ethernet communication and the execution of control programs on the product, when the user authentication function is enabled. The user authentication function is enabled by default only when settings are configured by GX Works2, which complies with the Cybersecurity Law of the People's Republic of China, and is normally disabled.
