Threats tagged 'chinese threat actors'

The 'Iron Man System' is a commercial Phishing-as-a-Service (PhaaS) operation that provides criminal buyers with a self-hosted phishing kit. It includes over 2,360 phishing templates impersonating trusted entities such as postal services, banks, and government agencies, targeting 130 countries. The system features a bilingual Chinese-English interface, a subscription licensing model tied to vendor-controlled authorization servers, and a build registry with 911 published versions. Resecurity, in collaboration with Microsoft's Digital Crimes Unit and industry partners, mapped and disrupted this infrastructure. The kit was used to send approximately 1 billion phishing emails targeting 75,000 organizations, capturing around 17.4GB of telemetry data. Multiple domains associated with the infrastructure have been identified as indicators of compromise.

A remote code execution zero-day vulnerability (CVE-2025-0994) in Cityworks, an asset management system, is actively exploited by a Chinese-speaking threat group called UAT-6382. The attacks, ongoing since January 2025, target local government utilities management systems in the United States. The attackers deploy web shells such as AntSword and Chopper, and use custom Rust-based loaders named TetraLoader to deliver Cobalt Strike beacons and VSHell malware. Their operations include reconnaissance, directory enumeration, and staging files for exfiltration. This activity demonstrates a high level of sophistication and language proficiency consistent with Chinese origin threat actors.