China-nexus Archives • Daily CyberSecurity

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks Twill Typhoon RAT campaign DLL side loading tradecraft

Twill Typhoon RAT Campaign Uses DLL Side Loading to Target APJ Networks

Do Son June 2, 2026

A stealthy cyber espionage operation is actively targeting organizations across the Asia-Pacific region. Specifically, security researchers recently...

Cisco Talos Unmasks UAT-8302’s Global Government Espionage Network UAT-8302 APT NetDraft Malware

Cisco Talos Unmasks UAT-8302’s Global Government Espionage Network

Do Son May 6, 2026

Cisco Talos has exposured the curtain on UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group that...

Red Menshen’s Sleeper Cells Hijack the Global Telecom “Nervous System” Red Menshen BPFdoor Stealth

Red Menshen’s Sleeper Cells Hijack the Global Telecom “Nervous System”

Do Son April 2, 2026

A months-long investigation by Rapid7 Labs has detailed the curtain on a quiet invasion. An advanced China-nexus...

Weaponizing Conflict: ThreatLabz Exposes Mustang Panda’s Rapid PlugX Campaign in the Middle East Mustang Panda PlugX Backdoor

Weaponizing Conflict: ThreatLabz Exposes Mustang Panda’s Rapid PlugX Campaign in the Middle East

Do Son March 16, 2026

Recently, cybersecurity researchers at ThreatLabz have uncovered a new campaign by a China-nexus threat actor. The operation,...

Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor BingX cyberattack FortiGate SSO Attacks Firewall Config Theft

BingX cyberattack FortiGate SSO Attacks Firewall Config Theft

Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor

Do Son March 9, 2026

Cybersecurity investigators at Cisco Talos have pulled back the curtain on a relentless espionage campaign targeting critical...

Google Dismantles UNC2814’s Global Espionage Network Fueled by Google Sheets UNC2814 Espionage GRIDTIDE Backdoor

Google Dismantles UNC2814’s Global Espionage Network Fueled by Google Sheets

Do Son March 2, 2026

A massive, years-long cyber espionage campaign has been successfully dismantled. Recently, a coordinated effort led by the...

Zero-Day Threat: UAT-8837 Targets North American Infrastructure Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage

Zero-Day Threat: UAT-8837 Targets North American Infrastructure

Do Son January 16, 2026

A sophisticated threat actor, tentatively linked to China, is aggressively targeting critical infrastructure in North America with...

GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

GOLD SALEM Abuses Velociraptor DFIR Tool as Ransomware Precursor Following SharePoint ToolShell Exploitation

Do Son December 15, 2025

A sophisticated cybercriminal group has been observed repurposing a legitimate digital forensics tool as a precursor for...

Huntress Uncovers Log Poisoning Campaign Linking Nezha and Ghost RAT in Widespread Asian Cyber Intrusions Nezha Web Compromise, Log Poisoning

Huntress Uncovers Log Poisoning Campaign Linking Nezha and Ghost RAT in Widespread Asian Cyber Intrusions

Do Son October 10, 2025

Huntress researchers have unveiled a new and highly creative intrusion technique that combines log poisoning, AntSword web...

BRICKSTORM Malware: China-Linked Hackers Stealthily Target US Tech and Legal Firms for 393 Days Mercenary Akula European Financial Targeting AI-Generated Malware React2Shell Exploit UAT-8837 Critical Infrastructure Attack APT36, BOSS Linux BRICKSTORM Malware, China Espionage Curly COMrades, MucorAgent Chinese APT - HTTP Client Tools Shuckworm Cyber Espionage