A China-linked advanced persistent threat group has reportedly used Artex, an AI-powered penetration testing tool, in attacks targeting ConnectWise. Hundreds of organizations were affected, with attackers gaining privileged access to some environments. Discover the cybersecurity implications of AI-assisted hacking, remote access exploitation, and the evolving threat landscape.

Trend Micro's report exposes PeckBirdy, a JavaScript-based C2 framework used by China-aligned APTs since 2023 and linked to modular backdoors (HOLODONUT, MKDOOR), stolen code-signing certificates, Cobalt Strike payloads, and exploits including CVE-2020-16040. Researchers analyzed 56 IoCs (domains, subdomains, IPs, WHOIS emails), confirmed many as illegitimate or previously weaponized, and published sample artifacts and full findings for download. #PeckBirdy #HOLODONUT

One of China's biggest espionage operations owes its success to longstanding Microsoft Exchange bugs, open source tools, and old malware.

One of China's biggest espionage operations owes its success to longstanding Microsoft Exchange bugs, open source tools, and old malware.

Sometimes a single opened email is all it takes to compromise a university network. Researchers at Proofpoint have uncovered a campaign they call UNK_MassTraction. A threat group believed to have ties to China was responsible. It compromised Roundcube mail servers at physics and engineering departments across universities in the United States and Canada. Campaign Scope and Target Selection The campaign has been active since at least May 2026.