(Kaspersky) GhostEmperor is a Chinese-speaking threat actor that has mostly focused on targets in Southeast Asia, including several government entities and telecom companies. The group stands out because it uses a formerly unknown Windows kernel-mode rootkit. Rootkits provide remote control access over the servers they target. Acting covertly, rootkits are notorious for hiding from investigators and security solutions. To bypass the Windows Driver Signature Enforcement mechanism, GhostEmperor uses a loading scheme involving a component of an open-source project named “Cheat Engine.” This advanced toolset is unique and Kaspersky researchers see no similarity to already known threat actors. Kaspersky experts have surmised that the toolset has been in use since at least July 2020.
Chinese state-sponsored actors, identified as Salt Typhoon, are deploying new snooping malware targeting organizations in Latin America. This malware is designed to gather intelligence and is part of a broader campaign b…
Chinese hackers, operating under the FamousSparrow group, are targeting government agencies in Latin America with a new backdoor named ‘SparroWocky.’ This campaign is linked to China’s strategic interest in countering U.…
The Chinese cyberespionage group FamousSparrow has shifted its focus to Latin America, specifically targeting governmental organizations in countries like Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Ric…
China-linked cyber espionage group, Fire Ant, has expanded its campaign beyond VMware to compromise Cisco routers and TACACS servers, leveraging a sophisticated toolkit to steal credentials and suppress logging. The grou…
The US government has disrupted a Chinese hacking platform and botnet, QTFY, used by Chinese threat actors to target military and critical infrastructure systems in the United States. The disruption targeted QScan and QT…
This week’s cybersecurity news highlights a range of active threats and vulnerabilities. A severe code injection flaw in Ray-Project Ray is being actively exploited by a Mirai-based botnet, while T-Mobile took drastic ac…
Russian state-sponsored APT actors are actively targeting routers worldwide to compromise critical infrastructure. These attacks involve exploiting vulnerabilities and leveraging SNMP to steal device configurations and t…
The UK and EU have jointly sanctioned Russian individuals and entities involved in cyberattacks and disinformation campaigns, coinciding with a US cybersecurity advisory highlighting ongoing Russian state-sponsored attac…
Russian state-sponsored actors are exploiting poorly configured and vulnerable networking devices, primarily routers, across critical infrastructure sectors worldwide. This joint cybersecurity advisory, released by numer…
The UK government has weakened proposed cybersecurity protections for its telecoms networks in response to pushback from telecom companies regarding the cost and practicality of implementing measures designed to counter…
Charter Communications experienced a data breach impacting approximately 4.9 million accounts following a sophisticated attack by the ShinyHunters extortion gang. The attackers gained access through a voice phishing (vis…
