Volt Typhoon ran its zero-day campaigns through rotating chains of hacked routers that ended on home devices inside the US.

Storm-0940 hit 2,250+ M365 tenants with stolen ConnectWise creds, Volt Typhoon is tied to a CVSS 10 Cisco SD-WAN zero-day, and Cl0p targets Oracle EBS.

A Volt Typhoon-linked actor has exploited a Cisco SD-WAN zero-day since 2023. Audit your logs and enable the Snort rules.

State-sponsored threat actors are compromising critical enterprise network infrastructure. Specifically, operators tracking as UAT-11473 breached Cisco Catalyst SD-WAN controllers across strategic industries. Intruders deployed a sophisticated in-memory malware suite dubbed KeyDrift into active system processes. This espionage campaign compromised satellite operators, aerospace manufacturers, defense contractors, and geopolitical think tanks. Furthermore, the malware extracts cryptographic keys directly from decrypted control streams.

Volt Typhoon-linked attackers exploited a CVSS 10 Cisco Catalyst SD-WAN zero-day since 2023 to steal encryption keys. Patch now.

victims have been identified read more about Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns

Cet article repose sur deux rapports simultanés : l'un de Cisco Talos et l'autre de Lumen's Black Lotus Labs, portant sur l'exploitation d'une vulnérabilité critique dans les équipements Cisco Catalyst SD-WAN.

Chinese state-sponsored hacking group Volt Typhoon has been using a framework that relies on rotating chains of connected devices compromised on demand, including for zero-day attacks targeting high-value systems. [...]

Twelve agencies warn Volt Typhoon rebuilds its covert SOHO router and IoT networks in under two minutes. Hunt short-lived sessions on perimeter devices.

Cet article s'appuie sur un rapport public de Black Lotus Labs (Lumen Technologies) et une présentation non publique donnée à la conférence LabsCon de SentinelOne en Arizona. Il documente pour la première fois les mécanismes techniques détaillés de l'infrastructure d'attaque de Volt Typhoon, groupe étatique chinois actif depuis au moins 2023.

Cet article s'appuie sur un rapport public de Black Lotus Labs (Lumen Technologies) et une présentation non publique donnée à la conférence LabsCon de SentinelOne en Arizona. Il documente pour la première fois les mécanismes techniques détaillés de l'infrastructure d'attaque de Volt Typhoon, groupe étatique chinois actif depuis au moins 2023.

TL;DR Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon's covert relay network.

TL;DR Threat actors tracked as UAT-11473 exploited a critical authentication bypass flaw in Cisco SD-WAN Catalyst Controllers to deploy a custom implant called KeyDrift malware. Through this KeyDrift malware UAT-11473 operation, attackers injected malicious modules directly into control-plane processes to steal encryption keys and maintain hidden backdoors. Furthermore, investigators found strong infrastructure links connecting this campaign to Volt Typhoon's covert relay network.

Iranian hackers’ attacks on water systems in 12 U.S. states exposed serious weaknesses in America’s critical water infrastructure and showed how a broader campaign could trigger a nationwide public health crisis. The article argues that the U.S. must urgently strengthen defenses with zero-trust architecture, formal methods, and AI-enabled cybersecurity support for utilities of all sizes. #IranianHackers #WaterSystems #ZeroTrustArchitecture #VoltTyphoon #ClaudeMythos

ANZ threat activity is dominated by identity- and access-driven compromise, with credential stuffing, stolen credentials, and initial-access broker sales recurring across financial services, manufacturing, and mining. Qilin is the most active cross-sector ransomware actor, while the report also highlights state-aligned pre-positioning by Volt Typhoon and Salt Typhoon, plus exploited vulnerabilities such as CVE-2023-20198, CVE-2025-59287, and CVE-2026-41940. #Qilin #VoltTyphoon #SaltTyphoon #CVE-2023-20198 #CVE-2025-59287 #CVE-2026-41940

Chinese hackers infiltrated US electric grid for over a year, exfiltrating critical data. #Cybersecurity #VoltTyphoon #CriticalInfrastructure

Xi whiz: Versa Networks criticized for swerving the blame.

a/k/a BRONZE SILHOUETTE: FBI head Wray won’t tolerate China’s “real-world threat to our physical safety.”