#кибершпионаж
-
China's Vapor Panda Hits Over 200 Organizations Using AI Framework ARTEX
CrowdStrike reports that China-based Vapor Panda is using ARTEX, an agentic framework built on large language models, to run dozens of intrusions at once with a small team.
-
China-Linked Warp Panda Used VMware ESX Zero-Day to Hide Its Tracks
CISA has added CVE-2026-41709 in VMware ESX to its catalog of exploited vulnerabilities. According to CrowdStrike, the Warp Panda group used it as a zero-day to leave fewer traces in audit logs during attacks on U.S. law firms.
-
Hackers Used a Cisco SD-WAN Flaw to Deploy KeyDrift, Malware Built to Steal Encryption Keys
Cisco Talos has described KeyDrift, malware that attackers planted on Catalyst SD-WAN control systems through the critical CVE-2026-20127 flaw. Its job is to copy the AES keys that encrypt traffic between sites.
-
Volt Typhoon Ran Four Zero-Day Campaigns Through the Covert Silent Train Network
Black Lotus Labs (Lumen Technologies) has linked Volt Typhoon to Silent Train, a now-disrupted covert network of constantly rotating chains of compromised routers, IoT devices and enterprise equipment. The group used it to exploit zero-days and hold on to access in strategically important US networks.
-
CERT-UA: Attackers Hijack Dahua Cameras in Ukraine via P2P Service and Weak Authentication
Ukraine's computer emergency response team has warned of unauthorized access to Dahua IP cameras and video recorders. The main loophole is the Easy4IP cloud P2P service combined with predictable device serial numbers.
-
China-Linked Hackers Used BeyondTrust Zero-Day to Seize Remote Support Servers
The espionage group Armory Castle exploited a critical flaw in BeyondTrust Remote Support as a zero-day back in late August — a month and a half before a fix shipped.
-
U.S. Offers Up to $10 Million for Information on HAFNIUM Suspect Zhang Yu
The State Department is willing to pay up to $10 million for information on Chinese national Zhang Yu, charged in the U.S. over the 2021 Microsoft Exchange Server attacks.
-
Linux Backdoors Pose as Email Security Tools to Hide in Korean and Taiwanese Networks
Rapid7 has detailed a family of Linux implants that disguise their traffic as email services and name their processes after SpamSniper and ShareTech, two email-security products popular across the region.
-
TA419 Targets U.S. AI Policy Experts With Microsoft AitM Phishing
A China-aligned cyber espionage crew is impersonating economists, policymakers and even an Anthropic employee to steal the credentials of experts shaping U.S. AI regulation.
-
MI5: Over 100 U.K.-Linked Academics Aided Chinese Spies via Front Institute
Britain's domestic intelligence agency has issued an unprecedented warning: the CGTRI research body funds work serving China's state security ministry, and many academics may not have known who was behind the money.
-
Chinese Group FamousSparrow Targets Latin American Governments with the SparroWocky Backdoor
ESET researchers have discovered a new modular backdoor, SparroWocky, that the China-linked group FamousSparrow is using for cyberespionage against government organizations in Latin America.
-
Red Heron Breaches 13 Organizations Through a Gitea Vulnerability
In a matter of days, the presumed Chinese group Red Heron turned a public Gitea exploit into an automated tool and struck targets across six countries.
-
Four Spy Groups Adopted the Same BlueMoon Exploit Kit Within a Week
Proofpoint has detailed a previously unknown exploit kit called BlueMoon that chains together Chrome and Windows vulnerabilities. Within a matter of days it was picked up by several cyberespionage groups, most of them linked to China.
-
Fire Ant Moves From Hypervisors to Cisco Routers
The Chinese cyber-espionage group Fire Ant is hijacking Cisco IOS XR routers, TACACS servers and Linux hosts, turning them into platforms for intercepting traffic and stealing credentials while blinding defenders' monitoring tools along the way.
-
US Justice Department Reworded Its Statement: Agencies Weren't Victims of Chinese Hackers, but Targets
The US Department of Justice has rewritten its press release about the cyber operation by the QTFY group: the agencies are now called “targets” rather than “victims” of the attacks. The change in wording indicates that only some of the organizations were actually breached.
-
ownCloud Flaw Used to Steal Nuclear Data in the Philippines
CISA added a critical ownCloud flaw to its exploited-vulnerabilities catalog after a Chinese-speaking group exfiltrated documents from a Philippine nuclear research center.
-
HOOKEDGE: How APT28 Hides Espionage in Free Webhooks
Researchers at Recorded Future have detailed a new backdoor from the Russian group APT28 that has targeted diplomats in Romania, Spain and Turkey and disguises its command-and-control as ordinary network traffic.
-
Russian Hackers Hijack Accounts via Google OAuth and WhatsApp Device Linking
Google Threat Intelligence Group has profiled three clusters of suspected Russian cyberespionage that abuse legitimate authentication mechanisms to seize the personal accounts of diplomats, academics and defense specialists.
-
Hacked Balochistan Police Portal Used in Cyber-Espionage Campaigns
Cybersecurity researchers have disclosed details of a long-running espionage operation against several Pakistani law enforcement organizations. The attacks, attributed to groups linked to China and India, ran from February 2024 to April 2026.
-
Hackers Exploit Roundcube Vulnerability to Spy on Academics
A China-linked group is attacking vulnerable Roundcube servers at universities in the US and Canada, stealing credentials and installing backdoors.