An aggressive Chinese hacking campaign is the most active state cyber threat to Canada, the country's signals intelligence agency said on Wednesday, in the latest warning about clandestine activity by...

URL reputation checker analysis becomes more valuable when a cyberattack moves beyond a single vulnerable application and touches multiple layers of an organization’s infrastructure. A camp...

Inside the Advanced Persistent Threat That Compromised Microsoft SharePoint—and the Cybersecurity Oversight That Made It Possible

 A Chinese threat actor has been using the recently discovered vulnerability in ZyXEL GS1900 switches to steal crucial information from the devices around the world, according to GreyNoise, a threat intelligence company. The vulnerability, tracked as CVE-2026-7273, has a CVSS score of 8.8 and is a stack-based buffer overflow, enabling a remote unauthenticated attacker to execute OS commands via a specially crafted HTTP request.  ZyXEL has issued security updates for ten GS1900 switch models in June. However, according to GreyNoise, the flaw was actively exploited in August, targeting the devices in 48 countries. The threat actors used a Python script, which was significantly obfuscated to hide its purpose, to extract the hashes of the root credentials, configuration, and network information from 996 affected switches.  While the script targeted the GS1900-24 switches with firmware versions 2.10 to 2.90, some of the command-line options in the script contained values related to libc base addresses and global offsets. Therefore, it might be possible that the threat actors could use the same vulnerability to target other firmware versions. The information stolen from the switches also showed that 564 devices were using default credentials. This lets the attackers effortlessly compromise these devices.  On Monday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog. Also, per the Binding Operational Directive 26-04, all federal agencies must remediate this issue within 3 days of its publication. GreyNoise also reported that the same threat actor conducted Ubiquiti attacks, which involved exploiting the zero-day flaws to gain remote access and execute arbitrary code in the devices.  In addition, the attackers used exploits targeting WordPress flaws to launch attacks against small businesses and government entities in July. The attacks entailed a threat actor compromising a Western government organization, stealing over 18000 sensitive documents from the agency’s backend database, and publishing the results on a Matrix communication service.  However, the cybersecurity firm is yet to confirm if any of these attacks were conducted by the same threat actor. Acronis, another cybersecurity firm, previously identified threat actors using the Red Heron hacking group, which primarily used Gitea’s zero-day flaw to target more than 100 organizations worldwide.

China's Cyberspace Administration, Ministry of Public Security, and Ministry of Industry and Information Technology introduced.

Washington – Chinese hackers remotely accessed several U.S. Treasury Department workstations and unclassified documents after compromising a third-party software service provider, the agency said Monday. The department did not provide details on how…

measures to identify such attacks read more about Chinese Hackers Use Anthropic's AI to Launch Automated Cyber Espionage Campaign

private sector entities read more about Chinese Hackers RedNovember Target Global Governments Using Pantegana and Cobalt Strike

routers through a network reconnaissance attempt read more about Chinese hackers also breached Charter and Windstream networks

remote code execution read more about Chinese Hackers Exploit Trimble Cityworks Flaw to Infiltrate U.S. Government Networks

taking advantage of a public-facing application read more about Chinese Hackers Breach Asian Telecom Remain Undetected for Over 4 Years.

start a series of attacks read more about China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

modular backdoor known as WizardNet read more about Chinese Hackers Abuse IPv6 SLAAC for AitM Attacks via Spellbinder Lateral Movement Tool

Explore the new SSH backdoor threat by Chinese cyberspies targeting Linux systems, revealing advanced malware tactics and security implications.

spear-phishing emails that look like they are from law read more about Chinese hackers abuse Microsoft APP-v tool to evade antivirus

Chinese hackers infiltrated the nation’s telecommunications systems, gaining the ability to listen to phone conversations and read text messages

A China-linked advanced threat group named Weaver Ant spent more than four years in the network of a telecommunications services provider, hiding traffic and infrastructure with the help of compromise...

(Reuters) -Microsoft is investigating whether a leak from its early alert system for cybersecurity companies allowed Chinese hackers to exploit flaws in its SharePoint service before they were patched, Bloomberg News reported on Friday. A security patch Microsoft (NASDAQ:MSFT) released this month failed to fully fix a critical flaw in the U.S. tech giant’s SharePoint server software, opening the door to a sweeping global cyber espionage effort. In a blog post on Tuesday, Microsoft said two allegedly Chinese hacking groups, dubbed "Linen Typhoon" and "Violet Typhoon," were exploiting the weaknesses, along with a third, also based in China. Microsoft did not immediately respond to a Reuters request for comment on the report.

https://www.osintinvestigate.com A new China-linked cyber campaign shows how AI agents are becoming operational tools for cyber espionage. The SecFlow framework reportedly connected commercial AI models such as Claude, Qwen, and DeepSeek to reconnaissance, exploitation, credential testing, data collection, and reporting. Targets included government, education, political, and industrial organizations across Asia. This episode explores how attackers are combining traditional hacking techniques with AI-driven automation, why exposed infrastructure helped researchers uncover the operation, and what this evolution means for cybersecurity defenders.