Volt Typhoon

UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127

• Cybercriminals

UAT-11473 Deploys KeyDrift Malware on Cisco SD-WAN Controllers via CVE-2026-20127

Do Son October 29, 2026 0

Cisco Talos uncovered the KeyDrift malware UAT-11473 campaign exploiting CVE-2026-20127 to steal IPsec keys from Cisco SD-WAN controllers.

JDY Botnet Resurges: China-Nexus IoT Army Hunts New Vulnerabilities Within Hours

• Malware

JDY Botnet Resurges: China-Nexus IoT Army Hunts New Vulnerabilities Within Hours

Do Son June 17, 2026 0

The JDY botnet, a China-nexus IoT network tied to Volt Typhoon, now spans 1,500+ devices and scans for new bugs like CVE-2026-35616 within hours.

Volt Typhoon: Chinese State-Sponsored APT Targets U.S. Critical Infrastructure

• Cyber Security
• Vulnerability

Volt Typhoon: Chinese State-Sponsored APT Targets U.S. Critical Infrastructure

Do Son November 21, 2024 0

Uncover the critical details about Volt Typhoon APT group: a state-sponsored threat targeting US critical infrastructure sectors.

Volt Typhoon APT Group Resurfaces: A Persistent Threat to Critical Infrastructure

• Cyber Security

Volt Typhoon APT Group Resurfaces: A Persistent Threat to Critical Infrastructure

Do Son November 14, 2024 0

Uncover the resurgence of the Volt Typhoon cyber-espionage group. Learn how this APT actor targets critical infrastructure by exploiting vulnerabilities in legacy network devices.

Pacific Rim: Sophos Exposes 5 Years of Chinese Cyber Espionage

• Cyber Security

Pacific Rim: Sophos Exposes 5 Years of Chinese Cyber Espionage

Do Son November 3, 2024 0

Uncover the sophisticated cyberattack campaign known as 'Pacific Rim.' Discover how China-based threat groups target high-value infrastructure and government organizations

Chinese Hackers Deploy VersaMem Web Shell via Versa Director Zero-Day (CVE-2024-39717)

• Cyber Security
• Malware
• Vulnerability

Chinese Hackers Deploy VersaMem Web Shell via Versa Director Zero-Day (CVE-2024-39717)

Do Son August 27, 2024 0

The VersaMem web shell, uncovered by Black Lotus Labs, is a sophisticated tool specifically designed to exploit Versa Director servers

Shadowy NuGet Package Raises Red Flags: Industrial Espionage Suspected

• Cyber Security
• Malware

Shadowy NuGet Package Raises Red Flags: Industrial Espionage Suspected

Do Son March 26, 2024 0

Industrial Espionage: The most alarming scenario is a targeted attack designed to steal sensitive data (credentials, design plans, etc.)

China-Backed Hackers Escalate Cyber Campaigns, Targeting Operational Technology

• Cyber Security

China-Backed Hackers Escalate Cyber Campaigns, Targeting Operational Technology

Do Son March 23, 2024 0

a trend in China-linked cyberattacks: a sustained focus on compromising Operational Technology environments within critical infrastructure

VOLTZITE Evolves: Threat Group Targets Critical Systems

• Cyber Security

VOLTZITE Evolves: Threat Group Targets Critical Systems

Do Son February 22, 2024 0

VOLTZITE, a threat group known for persistent targeting of global critical infrastructure sectors, continues to refine its methods

The Invisible Threat: KV-botnet Infects SOHO Devices Worldwide

• Cyber Security
• Malware

The Invisible Threat: KV-botnet Infects SOHO Devices Worldwide

Do Son February 10, 2024 0

The KV-botnet operates in the shadows, infecting small-office, home-office (SOHO) routers and firewall devices worldwide.