News Gist .News

Microsoft's Threat Intelligence has identified a new tactic from Chinese threat actor Silk Typhoon towards targeting "common IT solutions" such as cloud applications and remote management tools in order to gain access to victim systems. The group has been observed attacking a wide range of sectors, including IT services and infrastructure, healthcare, legal services, defense, government agencies, and many more. By exploiting zero-day vulnerabilities in edge devices, Silk Typhoon has established itself as one of the Chinese threat actors with the "largest targeting footprints".

A massive cybercriminal campaign has been discovered utilizing outdated and vulnerable Windows drivers to deploy malware against hundreds of thousands of devices. The attackers leveraged a signed driver, allowing them to disable antivirus programs and gain control over infected machines. This campaign is believed to be linked to the financially motivated group Silver Fox, which is known for its use of Chinese public cloud servers.

Hackers are exploiting Microsoft Teams and other legitimate Windows tools to launch sophisticated attacks on corporate networks, employing social engineering tactics to gain access to remote desktop solutions. Once inside, they sideload flawed .DLL files that enable the installation of BackConnect, a remote access tool that allows persistent control over compromised devices. This emerging threat highlights the urgent need for businesses to enhance their cybersecurity measures, particularly through employee education and the implementation of multi-factor authentication.

The U.S. government has indicted a slew of alleged Chinese hackers, sanctioned a Chinese tech company, and offered a $10 million bounty for information on a years-long spy campaign that targeted victims across America and around the world. The indictment accuses 10 people of collaborating to steal data from their targets, including the U.S. Defense Intelligence Agency, foreign ministries, news organizations, and religious groups. The alleged hacking scheme is believed to have generated significant revenue for Chinese intelligence agencies.

A broad overview of the four stages shows that nearly 1 million Windows devices were targeted by a sophisticated "malvertising" campaign, where malware was embedded in ads on popular streaming platforms. The malicious payload was hosted on platforms like GitHub and used Discord and Dropbox to spread, with infected devices losing login credentials, cryptocurrency, and other sensitive data. The attackers exploited browser files and cloud services like OneDrive to steal valuable information.

Vishing attacks have skyrocketed, with CrowdStrike tracking at least six campaigns in which attackers pretended to be IT staffers to trick employees into sharing sensitive information. The security firm's 2025 Global Threat Report revealed a 442% increase in vishing attacks during the second half of 2024 compared to the first half. These attacks often use social engineering tactics, such as help desk social engineering and callback phishing, to gain remote access to computer systems.

The modern-day cyber threat landscape has become increasingly crowded, with Advanced Persistent Threats (APTs) becoming a major concern for cybersecurity teams worldwide. Group-IB's recent research points to 2024 as a 'year of cybercriminal escalation', with a 10% rise in ransomware compared to the previous year, and a 22% rise in phishing attacks. The "Game-changing" role of AI is being used by both security teams and cybercriminals, but its maturity level is still not there yet.

Microsoft has confirmed that its Windows drivers and software are being exploited by hackers through zero-day attacks, allowing them to escalate privileges and potentially drop ransomware on affected machines. The company patched five flaws in a kernel-level driver for Paragon Partition Manager, which were apparently found in BioNTdrv.sys, a piece of software used by the partition manager. Users are urged to apply updates as soon as possible to secure their systems.

Security researchers spotted a new ClickFix campaign that has been abusing Microsoft SharePoint to distribute the Havoc post-exploitation framework. The attack chain starts with a phishing email, carrying a "restricted notice" as an .HTML attachment, which prompts the victim to update their DNS cache manually and then runs a script that downloads the Havoc framework as a DLL file. Cybercriminals are exploiting Microsoft tools to bypass email security and target victims with advanced red teaming and adversary simulation capabilities.

The US Department of Justice has announced charges against 12 Chinese hackers accused of targeting over 100 American companies, including the US Treasury. These individuals allegedly played a "key role" in recent cyberattacks and were linked to state-sponsored hacking groups, exploiting vulnerabilities in enterprise software. The DoJ also brought charges against eight individuals from organization Anxum Information Technology Co., Ltd., which was reportedly paid by Chinese authorities for its services.

Threat actors are exploiting misconfigured Amazon Web Services (AWS) environments to bypass email security and launch phishing campaigns that land in people's inboxes. Cybersecurity researchers have identified a group using this tactic, known as JavaGhost, which has been active since 2019 and has evolved its tactics to evade detection. The attackers use AWS access keys to gain initial access to the environment and set up temporary accounts to send phishing emails that bypass email protections.

The Department of Justice has criminally charged 12 Chinese nationals for their involvement in hacking over 100 US organizations, including the Treasury, with the goal of selling stolen data to China's government and other entities. The hackers used various tactics, including exploiting email inboxes and managing software, to gain access to sensitive information. China's government allegedly paid "handsomely" for the stolen data.

Sophisticated, advanced threats have been found lurking in the depths of the internet, compromising Cisco, ASUS, QNAP, and Synology devices. A previously-undocumented botnet, named PolarEdge, has been expanding around the world for more than a year, targeting a range of network devices. The botnet's goal is unknown at this time, but experts have warned that it poses a significant threat to global internet security.

Indian stock broker Angel One has confirmed that some of its Amazon Web Services (AWS) resources were compromised, prompting the company to hire an external forensic partner to investigate the impact. The breach did not affect clients' securities, funds, and credentials, with all client accounts remaining secure. Angel One is taking proactive steps to secure its systems after being notified by a dark-web monitoring partner.

US lawmakers have raised national security concerns in letters to top Chinese telecom companies, China Mobile, China Telecom, and China Unicom, citing the potential for these firms to exploit access to American data through their U.S. cloud and internet businesses. The lawmakers are seeking details on any links between the companies and the Chinese military and government by March 31, amid concerns about unauthorized data access, espionage, or sabotage. National security experts have warned that China Telecom's operations in the US could pose a significant risk to American telecommunications networks.

A cyber-attack like the one in Zero Day is improbable. The average Netflix viewer isn’t familiar with the technical details of how cyberattacks are carried out, but they’re acutely aware of their growing frequency and severity. Millions of Americans have had their data exposed in attacks, and while they may not fully understand what ransomware is, they know it isn’t good. While the critical reception of Zero Day remains to be seen, one thing is certain: viewers will debate the plausibility of the events unfolding on their screens.

Google Cloud has launched its AI Protection security suite, designed to identify, assess, and protect AI assets from vulnerabilities across various platforms. This suite aims to enhance security for businesses as they navigate the complexities of AI adoption, providing a centralized view of AI-related risks and threat management capabilities. With features such as AI Inventory Discovery and Model Armor, Google Cloud is positioning itself as a leader in securing AI workloads against emerging threats.

The Department of Justice has announced criminal charges against 12 Chinese government-linked hackers who are accused of hacking more than 100 American organizations, including the U.S. Treasury, over the course of a decade. The charged individuals all played a “key role” in China’s hacker-for-hire ecosystem, targeting organizations for the purposes of “suppressing free speech and religious freedoms.” The Justice Department has also confirmed that two of the indicted individuals are linked to the China government-backed hacking group APT27.

The advancements made by DeepSeek highlight the increasing prominence of Chinese firms within the artificial intelligence sector, as noted by a spokesperson for China's parliament. Lou Qinjian praised DeepSeek's achievements, emphasizing their open-source approach and contributions to global AI applications, reflecting China's innovative capabilities. Despite facing challenges abroad, including bans in some nations, DeepSeek's technology continues to gain traction within China, indicating a robust domestic support for AI development.

Former top U.S. cybersecurity official Rob Joyce warned lawmakers on Wednesday that cuts to federal probationary employees will have a "devastating impact" on U.S. national security. The elimination of these workers, who are responsible for hunting and eradicating cyber threats, will destroy a critical pipeline of talent, according to Joyce. As a result, the U.S. government's ability to protect itself from sophisticated cyber attacks may be severely compromised. The probe into China's hacking campaign by the Chinese Communist Party has significant implications for national security.

The new Genie Scam Protection feature leverages AI to spot scams that readers might think are real. This helps avoid embarrassing losses of money and personal information when reading text messages, enticing offers, and surfing the web. Norton has added this advanced technology to all its Norton 360 security software products, providing users with a safer online experience.

Microsoft has urged President Donald Trump's team to ease export restrictions imposed on artificial intelligence chips in the closing days of his previous administration, saying the measures should not extend to a group of U.S. allies. The tech giant claimed these rules placed limitations on allies, including India, Switzerland and Israel, and limited the ability of U.S. tech companies to build and expand AI data centers in these countries. Microsoft also warned that tighter U.S. restrictions could give China a strategic advantage in the long-term AI race.

The Justice Department has indicted 12 Chinese nationals for their involvement in a hacking operation that allegedly sold sensitive data of US-based dissidents to the Chinese government, with payments reportedly ranging from $10,000 to $75,000 per hacked email account. This operation, described as state-sponsored, also extended its reach to US government agencies and foreign ministries in countries such as Taiwan, India, South Korea, and Indonesia. The charges highlight ongoing cybersecurity tensions and the use of cyber mercenaries to conduct operations that undermine both national security and the privacy of individuals critical of the Chinese government.

The Lee Enterprises ransomware attack is affecting the company's ability to pay outside vendors, including freelancers and contractors, as a result of the cyberattack that began on February 3. The attack has resulted in widescale outages and ongoing disruption at dozens of newspapers across the United States, causing delays to print editions and impacting various aspects of the company's operations. Lee Enterprises has confirmed that hackers "encrypted critical applications," including those related to vendor payments.

A recent discovery has revealed that Spyzie, another stalkerware app similar to Cocospy and Spyic, is leaking sensitive data of millions of people without their knowledge or consent. The researcher behind the finding claims that exploiting these flaws is "quite simple" and that they haven't been addressed yet. This highlights the ongoing threat posed by spyware apps, which are often marketed as legitimate monitoring tools but operate in a grey zone.