Tag: Cobalt Strike
-
Cisco Talos Blog: UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud
Source URL: https://blog.talosintelligence.com/uat-8099-chinese-speaking-cybercrime-group-seo-fraud/ Source: Cisco Talos Blog Title: UAT-8099: Chinese-speaking cybercrime group targets high-value IIS for SEO fraud Feedly Summary: Cisco Talos is disclosing details on UAT-8099, a Chinese-speaking cybercrime group mainly involved in SEO fraud and theft of high-value credentials, configuration files, and certificate data. AI Summary and Description: Yes **Summary:** The provided text…
-
The Register: Hunt for RedNovember: Beijing hacked critical orgs in year-long snooping campaign
Source URL: https://www.theregister.com/2025/09/27/rednovember_chinese_espionage/ Source: The Register Title: Hunt for RedNovember: Beijing hacked critical orgs in year-long snooping campaign Feedly Summary: Not to be confused with all the other reports of Chinese intruders on US networks that came to light this week RedNovember, a Chinese state-sponsored cyberspy group, targeted government and critical private-sector networks around the…
-
The Register: AI-powered penetration tool, an attacker’s dream, downloaded 10K times in 2 months
Source URL: https://www.theregister.com/2025/09/11/cobalt_strikes_ai_successor_downloaded/ Source: The Register Title: AI-powered penetration tool, an attacker’s dream, downloaded 10K times in 2 months Feedly Summary: Shady, China-based company, all the apps needed for a fully automated attack – sounds totally legit Villager, a new penetration-testing tool linked to a suspicious China-based company and described by researchers as “Cobalt Strike’s…
-
Cisco Talos Blog: UAT-7237 targets Taiwanese web hosting infrastructure
Source URL: https://blog.talosintelligence.com/uat-7237-targets-web-hosting-infra/ Source: Cisco Talos Blog Title: UAT-7237 targets Taiwanese web hosting infrastructure Feedly Summary: Cisco Talos discovered UAT-7237, a Chinese-speaking advanced persistent threat (APT) group active since at least 2022, which has significant overlaps with UAT-5918. AI Summary and Description: Yes Summary: The text discusses the activities of UAT-7237, a Chinese-speaking advanced persistent…
-
Cisco Talos Blog: UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware
Source URL: https://blog.talosintelligence.com/uat-6382-exploits-cityworks-vulnerability/ Source: Cisco Talos Blog Title: UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware Feedly Summary: Talos has observed exploitation of CVE-2025-0994 in the wild by UAT-6382, a Chinese-speaking threat actor, who then deployed malware payloads via TetraLoader. AI Summary and Description: Yes **Summary:** The text describes the exploitation of a significant remote-code-execution…
-
The Register: Ghost ransomware crew continues to haunt IT depts with scarily bad infosec
Source URL: https://www.theregister.com/2025/02/20/fbi_beware_of_ghost_ransomware/ Source: The Register Title: Ghost ransomware crew continues to haunt IT depts with scarily bad infosec Feedly Summary: FBI and CISA issue reminder – deep sigh – about the importance of patching and backups The operators of Ghost ransomware continue to claim victims and score payments, but keeping the crooks at bay…
-
Microsoft Security Blog: The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation
Source URL: https://www.microsoft.com/en-us/security/blog/2025/02/12/the-badpilot-campaign-seashell-blizzard-subgroup-conducts-multiyear-global-access-operation/ Source: Microsoft Security Blog Title: The BadPilot campaign: Seashell Blizzard subgroup conducts multiyear global access operation Feedly Summary: Microsoft is publishing for the first time our research into a subgroup within the Russian state actor Seashell Blizzard and its multiyear initial access operation, tracked by Microsoft Threat Intelligence as the “BadPilot campaign”.…
-
Unit 42: CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
Source URL: https://unit42.paloaltonetworks.com/?p=138128 Source: Unit 42 Title: CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia Feedly Summary: A Chinese-linked espionage campaign targeted entities in South Asia using rare techniques like DNS exfiltration, with the aim to steal sensitive data. The post CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia appeared first…