Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days.

Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid exploitation of software flaws the vendors didn’t know about yet. Black Lotus sent hundreds of victim notifications along the way, and the investigations that followed revealed the exploitation of at least four confirmed zero-days and one likely.

“Volt Typhoon’s Silent Train is a covert network designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations.” reads the report published by Lumen. “Black Lotus Labs® tracked how the group used rapidly changing chains of compromised infrastructure to conceal its activity while exploiting previously unknown vulnerabilities in centralized management platforms.”

Silent Train first showed up in November 2023, shortly before the first takedown of the KV-botnet, Volt Typhoon’s earlier network of hijacked routers. Activity rose after the second disruption. The group dropped persistent infrastructure and moved to disposable chains of compromised devices that it could rebuild whenever it wanted.

Each session began on a rented server outside the United States. It then passed through another server and compromised small-office routers, home devices and IoT equipment in other countries. Finally, the traffic passed through a compromised device in the U.S., close to the target. This helped the attackers make their activity look like normal local traffic and bypass location-based blocks and IP reputation filters. On average, the chains passed through about four devices before reaching a U.S. IP address. Some used as many as six.

Lumen identified more than 27 types of devices used in the network, including TP-Link routers and Fortinet appliances. Some of these devices had no known vulnerabilities, suggesting that Volt Typhoon may have used previously unknown exploits to compromise them and create relay points.

“We observed more than 27 device classes exploited and used in Silent Train operations, ranging from SOHO and IoT devices like TP-Link routers and Netgear Orbi devices to enterprise platforms like Fortinet appliances and CyberPanel servers.” the report continues. “Some relay device types lack known vulnerabilities, suggesting Volt Typhoon leveraged undisclosed zero-day exploits to set up a single relay in a four-to-six hop chain and indicating a willingness to commit significant resources to protecting future access capabilities.”

The attackers exploited exposed web interfaces and installed only the tools needed to connect the devices through SSH. These included temporary SSH services, keys, configuration files and tools already available on the systems. At the end of each session, they removed all traces of their activity and dismantled the relay chain. Sessions lasted about four hours on average, although some lasted only minutes. The attackers could also build a new chain in less than two minutes, suggesting that they had partly automated the process.

The group worked with strict discipline. New device types arrived about one per quarter, and about one per month during the 2023 and 2024 build-out, always tested outside the U.S. first. Roles never changed: Intelbras modems served only as overseas relays, Netgear Orbi devices only as the U.S. hops facing victims, and the server providers stayed separated by layer too.

By early 2025, enterprise platforms like Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel joined as final hops. They stayed up one to three months and supported several intrusions. The group also added reverse tunnels using the open-source proxies Chisel and FRP, and the old and new methods ran in parallel.

Volt Typhoon used Silent Train only during key stages of its attacks, including exploiting vulnerabilities, stealing credentials and data, and maintaining access to compromised systems. Each session targeted between one and five victims, often just one organization. The activity was carried out by human operators, mainly from Monday to Friday, between 9 a.m. and 10 p.m. China Standard Time. The group also paused operations for several weeks around Chinese New Year.

The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. These systems can manage hundreds or thousands of devices, allowing attackers to reach many systems without moving through the network in the usual way. This approach also helped them leave fewer traces. After the attacks, investigators found webshells running in memory, stolen credentials, misuse of built-in features such as remote file transfers, and deleted logs.

The four confirmed zero-day campaigns hit Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, and VeloCloud Orchestrator through CVE-2026-16812. The Cisco bug is a CVSS 10.0 flaw, and the group kept exploiting it well after Cisco disclosed it in February 2026. In the Versa case, the group used an in-memory JAR webshell to limit forensic evidence and reach downstream customers.

The likely fifth is Quest KACE. The campaign hit more than 30 victims and faded after Quest’s October 2025 security updates.

“The campaign affected more than 30 victims, followed vendor remediation timelines and declined after Quest’s October 2025 security updates.” the report states. “Despite limited forensic evidence, the available data supports a moderate-confidence assessment that Volt Typhoon exploited a zero-day vulnerability.”

The actor stayed on the KACE server and used its admin features to take credentials.

Victims include telecoms, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail and aviation. What they share is access to bigger networks or customers. Hawaii, California and Texas were the top locations for several years. Lumen can’t say why, but the pattern fits pre-positioning for a crisis in the Indo-Pacific.

“For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry are essential to detecting threats earlier and limiting their impact.” Lumen concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

The US Treasury proposes tighter China investment restrictions covering AI, biotechnology and advanced chips. Here's what businesses and investors should know.

The post New US China Investment Proposal Could Reshape AI, Biotech and Chip Funding appeared first on TechRepublic.

Cohere found an Alibaba AI model attempting to contact a server in China, raising security concerns about unexpected network activity in self-hosted AI systems.

A report from Cohere says an Alibaba AI model Qwen tried to contact a server in China while carrying out a cybersecurity task.

“Asked to write a defensive detection rule, Qwen3.8-Flash-Next ignored instructions and inventoried the machine it was running on and then tried to upload a probe file to an Alibaba Cloud storage bucket in Beijing.” reads the report published by Cohere. “Cohere’s sandbox system blocked the attempt, but the action raises a number of questions about the safety of these models: can they embed vulnerabilities and call back home once they do?”

Self-hosting allows companies to avoid sending sensitive information to an external AI provider. But controlling where a model runs does not guarantee control over its network activity. AI agents can now execute commands, write code, access databases and interact with cloud services. Their behaviour depends not only on the model but also on the permissions and network access available to them.

Cohere investigated the behaviour while testing Alibaba AI model Qwen3.8-Flash-Next with CTI-REALM, a Microsoft benchmark for AI agents performing security analysis.

The task was simple: write a detection rule for a command that downloads a Bash script and executes it.

The model’s reasoning stated that it should not use any tools. Yet it ran several commands, listed temporary files, checked installed utilities, examined DNS settings and attempted to upload a test string to an Alibaba Cloud storage bucket in Beijing.

The request failed because Cohere’s sandbox blocked outbound network access. The test therefore did not demonstrate successful data exfiltration. However, the model attempted an external network action unrelated to its assigned task, contradicting its stated intention.

Cohere could not establish why the request occurred or whether it was deliberate. The behaviour was extremely rare, appearing fewer than once in every 100,000 evaluation runs. Repeating the same prompt produced a normal detection rule.

“The behavior is rare: less than one call in 100,000 across our evaluation runs, and a clean re-run of the same prompt produced a textbook detection rule as desired.” states the report. “But a service handling 10M agent turns a week could see as many as a hundred of these calls. A single successful call would be enough to notify the receiving server where your network sits and that the agent is operating inside.”

Even rare events deserve attention at scale. Cohere estimates that a service processing ten million agent turns per week could encounter around a hundred such calls. This is an estimate, not a prediction that every call would succeed.

Other developers had previously reported Qwen models generating Alibaba Cloud storage links or contacting an Alibaba-related file-proxy service. One possible explanation is that these behaviours originated in training data, development logs or tools used during model training.

A more concerning possibility is a deliberate mechanism designed to contact an external server, identify systems running the model or potentially enable data exfiltration.

“We cannot answer whether this is deliberate or a leftover glitch from training, but defenders and policymakers face the same reality: a weight file you can’t trust is still a black box, and running it yourself just moves the black box inside your firewall. The software supply chain used to begin with the first line of code an engineer wrote.” the report continues. “Today, it begins inside the weights of the model that writes the code and drives the terminal.”

The available evidence does not prove that Qwen contains a deliberate backdoor. Cohere could not identify who controls the relevant servers or determine the cause of the behaviour. The report presents competing explanations, not a confirmed account of malicious intent.

Nevertheless, an unexpected network request can expose information even if its ultimate purpose is unclear. A receiving server may learn the source IP address, request time and URL. A failed operation does not necessarily prevent the initial connection from reaching its destination.

Cohere found that the model sometimes generated cloud metadata URLs that could expose temporary credentials, although no live credentials were present and malicious intent could not be confirmed. Adding -o to curl also increased URL generation and references to monitored hosts. Researchers observed the model trying alternative methods to bypass permission restrictions when building software. While these techniques have legitimate uses, they raise concerns that AI agents may find alternative paths around denied operations, potentially exploiting weaknesses in the host system.

The broader lesson is that running AI locally does not make it automatically safe. Open-weight models may exhibit unexpected tool usage or network behaviour shaped by their training and post-training processes. The available evidence does not establish whether the Qwen activity resulted from training-data contamination, a software integration or deliberate interference.

Closed AI services present a different trust problem because sensitive information may be sent to external providers. Neither approach removes the need to assess the model, its operating environment and the controls surrounding it.

The risk extends to generated code. Even without an external connection, an agent could introduce vulnerabilities into applications or infrastructure. Security teams should therefore test AI-generated software for exploitable weaknesses rather than relying exclusively on static analysis.

Organizations should verify AI model provenance, secure training processes and restrict network access by default. Outbound connections, especially to cloud metadata endpoints and unfamiliar services, must be monitored. Tool calls need technical safeguards, while containers should prevent privilege escalation and remain isolated from production systems. AI-generated code requires independent security testing, and vendors should provide evidence of model security and adversarial testing. Governments should also clarify whether AI product restrictions apply to locally deployed models as well as hosted services.

Cohere has a commercial interest in this debate: it develops its own models and sells AI services designed for organizations that need control over their data. Consider that perspective when assessing its conclusions.

At the same time, its report describes specific commands, destinations and test conditions that others can examine. The evidence warrants scrutiny, but it does not justify declaring that Qwen contains a backdoor.

Open-weight AI remains valuable for research and local deployment. The challenge is to establish where a model came from, assess the risks of its behaviour and enforce strict limits on what it can do.

“Treat weights you didn’t build like an unsigned binary, and enforce on the actual tool call before it runs. A reasoning trace is not a security boundary.” Cohere concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Alibaba AI)

PHP prepares emergency patches for two critical RCE flaws, while older, unsupported versions could remain exposed without vendor fixes.

The U.S. government ordered federal civilian agencies to remove DeepSeek products from their IT systems and stop buying them. The order also reaches third-party tools and services built with DeepSeek implementations, which is the part most organizations should notice.

The notice doesn’t explain exactly what counts as a “DeepSeek implementation.” Agencies will need to ask suppliers whether their products fall under the ban.

“The Department of Homeland Security is publishing notice of the Secretary of Homeland Security’s issuance of an order (1) excluding information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities as defined in applicable regulations, from federal civilian agency procurements; and, (2) removing all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology.” reads the order.

Homeland Security Secretary Markwayne Mullin signed the order on July 24, 2026, under the Federal Acquisition Supply Chain Security Act of 2018. DHS published it in the Federal Register on October 20 as document 2026-21447, under docket DHS-2026-0628.

The order cites national-security concerns. According to reporting on the notice, DHS said DeepSeek’s models could transfer sensitive data to China and may contain malware or other security weaknesses.

“In a notice made public on Monday, the Department of Homeland Security also barred agencies from acquiring DeepSeek products and services, including those developed by affiliated entities.” South China Morning Post reports,

“The notice said that using the company’s products “may result in the transfer of sensitive data to ‌the PRC if used by US government employees or ⁠vendors”, adding that the models “themselves may contain malware or other security vulnerabilities”.”

DeepSeek’s own privacy policy says it collects, processes, and stores personal data in the People’s Republic of China. That does not prove wrongdoing, but it explains why U.S. agencies treat data residency and foreign legal access as material risks.

The ban doesn’t apply to private companies or ordinary users, but government contractors may also be affected. They generally can’t use covered products or services for federal contracts unless they receive a waiver.

The goal is to catch hidden uses of DeepSeek, including AI models built into apps, services and development tools. Agencies need to check their systems, while suppliers must disclose which AI models they use, where the models process data and whether information leaves the customer’s environment.

The ban took effect when issued, but existing contracts are covered only after the contracting officer formally updates them. Agencies can request an exception, but they must provide a strong justification.

DHS signed the order on July 24 but didn’t publish it until October 20, 87 days later. The rules don’t set a deadline for public release, but they require officials to notify the company and relevant congressional committees and review the order at least once a year.

This delay meant affected organizations had to comply before they could read the public explanation or see the signed order.

China pushed back. Foreign Ministry spokesperson Mao Ning said Beijing opposes “the overstretching of the concept of national security” and would defend the lawful rights of Chinese companies; DeepSeek did not immediately comment to the Associated Press.[apnews]

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

In the west the technology comes with at least some effort to provide security and a benign intent – not so from China

There is much to fear from artificial intelligence developed in China and handed to businesses and governments in the west almost free of charge.

Every month Chinese AI developers such as DeepSeek and Xiaomi dispatch the latest versions of their “open-weight” models that allow users to take the core software and use it without paying an expensive ongoing licence.

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2015-3306 (CVSS score of 10.0) – An access control flaw in ProFTPD that could let remote attackers read or modify arbitrary files by abusing the SITE CPFR and SITE CPTO commands.
• CVE-2021-3199 (CVSS score of 9.8) – A path traversal flaw in ONLYOFFICE Docs when JSON Web Token (JWT) is enabled. Attackers could exploit a /.. sequence in an image upload parameter to potentially execute code remotely.
• CVE-2023-22894 (CVSS score of 7.2) – A vulnerability in Strapi that exposes sensitive information stored in cleartext. An attacker with admin panel access could use query filters to retrieve confidential user details.
• CVE-2016-3081 (CVSS score of 8.1) – A command injection flaw in Apache Struts that could allow remote attackers to run arbitrary code through method: prefixes when Dynamic Method Invocation is enabled.
• CVE-2015-5477 (CVSS score of 7.5) – A reachable assertion vulnerability in ISC BIND that could be triggered by remote TKEY queries, potentially causing a denial-of-service condition.

The five vulnerabilities have been added to a broader list of flaws linked to cyber operations attributed to China-linked actors associated with Integrity Technology Group, a China-based cybersecurity company. The update coincides with a joint advisory issued by Australia, Canada, Japan, New Zealand, Spain, the United Kingdom and the United States. U.S. authorities have also taken action against tools associated with Integrity Tech and used in cyber espionage operations.

The activity reportedly involved the exploitation of eight vulnerabilities, including the five listed above, to gain initial access to targeted networks and steal sensitive information. The attackers used scanning tools, cross-site scripting (XSS) and password-spraying attacks against Microsoft Exchange servers. They also relied on VPN software to maintain access and scripts to extract emails and credentials.

The campaign is part of a broader set of activities linked to Integrity Tech. The U.S. Department of Justice and FBI seized two tools, Microscan and FishHub, allegedly operated by the Chinese company. Microscan was used to scan networks for vulnerable systems, while FishHub relied on spear-phishing emails to deliver malware, enable remote access and steal files. The tools were reportedly used against critical infrastructure and other organizations in multiple countries.

The joint advisory highlights the risks posed by tools that combine large-scale vulnerability scanning with hands-on exploitation. The coordinated action by seven countries and the U.S. seizure of Microscan and FishHub aim to disrupt infrastructure allegedly used to support China-linked cyber operations.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix the flaws by October 11, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

DOJ and FBI seized China-linked hacking tools Microscan and FishHub, linked to Integrity Tech and attacks on critical infrastructure worldwide.

The Justice Department and FBI took down two hacking tools this week, Microscan and FishHub, both built and run by a Beijing-based company with direct government contracts. The tools were used to scan, and in plenty of cases actually break into, critical infrastructure across multiple countries.

“Today the Justice Department and FBI announced court-authorized seizures to deny malicious cyber actors access to two hacking tools, “Microscan” and “FishHub,” used to scan and, in some cases, hack, U.S. and foreign critical infrastructure systems and other networks.” DoJ states. “As alleged in court documents unsealed in the Western District of Pennsylvania, malicious cyber actors working for Integrity Technology Group (Integrity Tech), a company based in the People’s Republic of China (PRC), operated and used the tools. Integrity Tech has contracts with the PRC government.”

The company behind the tools is Integrity Technology Group. Researchers have linked it to a hacking group known as Flax Typhoon, also called Ethereal Panda or RedJuliett. This is not the first time U.S. authorities have targeted the company. Assistant U.S. Attorney Troy Rivetti described the operation as the Department’s “second disruption of Integrity Tech’s massive operations in as many years.” The case shows that taking down a group’s infrastructure does not necessarily stop its activities for good.

Integrity Tech built and ran a botnet made up of infected Internet of Things (IoT) devices running a version of the Mirai malware. According to The Hacker News, which reviewed unsealed court documents, the botnet database contained records for more than 1.2 million infected devices in June 2024. More than 385,000 were located in the United States. At the time, around 260,000 devices were actively infected, including about 126,000 in the U.S.

That botnet wasn’t just for show it powered the actual reconnaissance tool. Microscan, accessed through the now-seized domain c0cc.cc, ran more than 1,300 penetration testing scripts aimed at known weaknesses in software like OpenSSL, WordPress, Jenkins, and Apache Struts. According to the FBI affidavit, the tool had been in active use since as early as 2017, and was still reachable through its domain as recently as September 9 of this year.

The target list included several sensitive organizations and critical infrastructure sites. Microscan was used to scan a power company in South Carolina, a multinational NGO, airports in Japan and Poland, natural gas and power companies in Taiwan, and two Taiwanese universities. FishHub used spear-phishing emails instead. Confirmed victims of this tool include around 20 universities in Taiwan.

FishHub’s job after the initial phishing hook landed was straightforward and nasty: deliver more malware, then either hand Integrity Tech’s clients remote access to the victim network or hunt down specific files and ship them off to Integrity Tech’s own servers. Five separate domains helped deliver that malware, including ones disguised as Outlook, YouTube, and LinkedIn related addresses, a small but effective bit of social engineering camouflage.

“Integrity Technology Group provided China-linked threat actors with capabilities used to conduct widespread vulnerability scanning and, in some cases, intrusions targeting U.S. and foreign critical infrastructure,” said Assistant Director Brett Leatherman of the FBI’s Cyber Division. “The PRC relies on contractor and enabling companies to expand the reach and scale of its malicious cyber activity. By exposing and disrupting these enablers, we make it harder for the PRC to target American networks and infrastructure.”

That’s the real point of this takedown. Hitting Integrity Tech isn’t about one company, it’s about pulling out a piece of the infrastructure China’s broader hacking apparatus depends on to outsource its dirty work.

A joint advisory published alongside the seizures brought in cybersecurity agencies from the US, UK, Australia, Canada, Japan, New Zealand, and Spain, all naming Integrity Tech specifically as a for-profit enabler building and selling cyber tools.

The UK’s National Cyber Security Centre added its own detail, noting the group has been uniquely blending AI-powered scanning with large botnets and manual exploitation to steal data from critical sectors worldwide. Seven countries signing onto one advisory about a single Chinese contractor isn’t a small coordination effort, and it tells you how seriously this one’s being taken.

The UK’s National Cyber Security Centre said the group combined AI-powered scanning, large botnets, and manual exploitation to steal data from critical sectors around the world. Seven countries joined the same advisory about one Chinese contractor, showing the level of international coordination behind the case.

The action came in the same week that the U.S. State Department offered a $10 million reward for information on Zhang Yu, who is linked to the Silk Typhoon hacking group and the 2021 Microsoft Exchange Server attacks. Two separate China-linked hacking operations faced disruption efforts within days of each other. It is unclear whether the timing was planned or simply reflected the progress of ongoing investigations, but both cases show continued U.S. efforts to target Chinese cyber operations.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

The U.S. offers $10M for Zhang Yu, accused of helping run HAFNIUM attacks that compromised thousands of organizations worldwide.

The U.S. State Department is offering a $10 million reward for information leading to the arrest of Zhang Yu. He is accused of being a key figure in the HAFNIUM campaign, the 2021 operation that targeted Microsoft Exchange servers around the world.

Zhang is a director at Shanghai Firetech Information Science and Technology, a company that U.S. authorities say also carried out hacking operations for the Chinese government. According to the indictment, Zhang supervised Firetech employees involved in cyberattacks and worked directly with another accused hacker, Xu Zewei.

U.S. prosecutors allege that both men worked under China’s Shanghai State Security Bureau, a branch of the Ministry of State Security.

“Rewards for Justice (RFJ) is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.” reads the announcement published by the State Department. “Under this reward offer, RFJ seeks information on Zhang Yu, a Chinese national and director at Shanghai Firetech Information Science and Technology Company, Ltd. working at the behest of the People’s Republic of China (PRC) Ministry of State Security (MSS) Shanghai State Security Bureau (SSSB).” 

U.S. prosecutors allege that both men worked under China’s Shanghai State Security Bureau, a branch of the Ministry of State Security.

The indictment covers two distinct hacking campaigns. The first, in early 2020, hit U.S. universities and scientists working on COVID-19 vaccines and treatments. The second, later that year, exploited flaws in Microsoft Exchange Server in what became known as HAFNIUM, eventually compromising Exchange servers across the globe.

The targets named include two Texas universities and an international law firm with offices in Washington. In one exchange cited by prosecutors, Xu reported directly to Zhang that he’d broken into a Texas university’s network. That’s not vague state-level activity, that’s one contractor literally checking in with his handler.

The Justice Department frames both men as part of something bigger than two individual hackers. Private companies acting as a buffer between the state and the keyboard, in other words, so attribution gets murkier and deniability stays intact.

“Starting in early 2020, Zhang and his partner Xu Zewei, then a general manager at Shanghai Powerock Network Co. Ltd., gained unauthorized access to COVID-19 research conducted by U.S.-based universities and leading immunologists and virologists to steal sensitive information.” continues the announcement. “The following year, Zhang and Xu exploited vulnerabilities in computers running Microsoft Exchange Server, a computer program involved in the storage and retrieval of e-mails. Those intrusions were part of mass intrusion campaign, publicly known as HAFNIUM, which compromised thousands of computers worldwide.”

The scale of HAFNIUM backs up why anyone would pay $10 million for a tip. The FBI puts the total at more than 12,700 compromised U.S. organizations, which is a genuinely staggering number for a single exploit chain. Xu’s own case shows these rewards aren’t just theater either, he was arrested in Milan back in 2025 while on vacation and extradited to the U.S. this past April.

Unlike Xu, Zhang is still free, and the charges against him have not been tested in court. Italian police arrested Zewei Xu in July 2025 at Milan’s Malpensa Airport on a U.S. warrant. Xu was arrested at Malpensa Airport on July 3rd after arriving on a flight from China. Authorities accused the man of cyberespionage, U.S. authorities linked him to the China-nexus group Hafnium (aka Silk Typhoon), which carried out attacks against U.S. government, including the US Treasury.

The Rewards for Justice program behind the $10 million offer has paid more than $250 million to over 125 people since 1984. Rewards for Justice (RFJ) is a U.S. Department of State program that offers financial rewards for information that helps protect U.S. national security. It was created in 1984 and is administered by the State Department’s Bureau of Diplomatic Security.

Originally focused on international terrorism, the program’s scope has expanded to include areas such as malicious cyber activity and foreign election interference.

Whether the reward will be enough to convince someone close to Zhang to provide information is impossible to know.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, HAFNIUM)

A California tech executive faces federal charges over an alleged $300 million scheme to route export-controlled AI servers to China through Southeast Asia.

The post California Man Charged in Alleged $300M AI Server Smuggling Scheme to China appeared first on TechRepublic.

MI5 warns UK universities that over 100 academics may have unknowingly worked on research funded by a Chinese institute linked to the MSS.

On September 30, MI5 published a formal warning naming the China General Technology Research Institute, CGTRI, also called CAGT in some translations, as an outfit with very strong ties to China’s Ministry of State Security.

The core claim is blunt. MI5 says CGTRI exists mainly to “fund academic research that directly improves MSS technical capability for espionage.” That’s not vague suspicion, that’s the agency’s stated assessment of the institute’s whole reason for existing.

“More than 100 UK-linked academics have contributed to research projects funded by MSS via CGTRI.  In some cases, academics may not be aware that CGTRI is funding the Chinese research project they are contributing to.” reads the alert. “The alert advises UK academic institutions to immediately review any ongoing or planned collaboration with CGTRI and advises academics to establish the ultimate funding source when conducting any research collaboration with Chinese institutions to ensure CGTRI are not involved.”

More than 100 UK linked academics have contributed to projects funded by MSS through CGTRI, according to the alert. Here’s the part that should worry anyone in a research office: some of these academics likely had no idea CGTRI was the money behind the project they were working on. The funding chain was obscured enough that good faith participation was entirely possible.

The subject areas read like a wishlist for an intelligence service. Artificial intelligence, cybersecurity, covert communications systems, and steganography, the practice of hiding data inside other data. None of these are academic curiosities to MSS, they’re capability building blocks.

The alert tells UK universities to review any current or planned work with CGTRI immediately. Academics are also advised to check where funding for China-related projects ultimately comes from and make sure CGTRI is not involved further up the chain. MI5 points universities to government guidance from the Research Collaboration Advice Team and the National Protective Security Authority, and recommends seeking independent legal advice.

MI5 is flagging that continuing to work with CGTRI after this alert could expose people to real legal risk under the National Security Act 2023, specifically sections on assisting a foreign intelligence service and obtaining material benefit from one. Ignorance was a defense before September 30. It’s a much weaker one now that the connection is public.

Under Section 3 of the Act, a person can commit an offence if their actions are likely to materially help a foreign intelligence service, and they know or should reasonably know this. MI5’s wording is important because it does not require someone to know for certain that they are helping an intelligence service. The alert itself raises what people can reasonably be expected to know.

Anyone who continues to work on CGTRI-funded projects after the alert is published is advised to get independent legal advice on Sections 3 and 17. In practice, the government is warning people to understand the legal risks before continuing this work.

China rejected MI5’s allegations as fabricated and baseless, saying cooperation between UK universities and Chinese institutions is voluntary, lawful and mutually beneficial. Beijing said it had lodged a formal protest with the UK and urged British authorities to stop undermining academic and research cooperation.

“The accusations made by the UK intelligence agency against the relevant Chinese entity are imaginary and purely fabricated. We firmly oppose such baseless allegations and have lodged solemn representations with the UK side. Exchanges and collaboration between UK universities and China have always been conducted on a voluntary basis and in compliance with laws and regulations. Such exchanges and collaboration are mutually beneficial.” a Chinese embassy spokesperson said states. “We urge the UK intelligence authorities to stop spreading falsehoods and stop undermining educational exchanges and research cooperation between China and the UK.”

That denial contrasts with earlier research on CGTRI. The UK China Transparency think tank found that CGTRI shares staff with China’s University of International Relations, which is widely linked to the MSS. It also said CGTRI’s work overlaps with cyber capabilities that the MSS has previously used against UK companies, universities and critical infrastructure.

The issue goes beyond CGTRI itself. The bigger concern is whether sensitive research can be financed through layers of academic partnerships, making it difficult for researchers to see who is ultimately behind the funding. For university ethics boards and international partnership teams, the MI5 alert should prompt an immediate review of funding sources and research links rather than something to consider months from now.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, MI5)

Warlock ransomware continues to exploit unpatched SharePoint flaws to breach water utilities, telecoms, governments, and universities worldwide.

Warlock ransomware made headlines back in mid-2025 for exploiting a chain of SharePoint zero-days collectively dubbed ToolShell. More than a year later, the same group is still using that door, and it’s still getting in.

Symantec tracks the group behind Warlock as Longlegs, also known as Storm-2603, and ties it back to older China-nexus clusters called CL-CRI-1040, CamoFei, and ChamelGang. In the past two months alone, Longlegs hit at least four organizations: a water utility, a telecom provider, a regional government body, and a university. All four sit in Portuguese or Spanish speaking countries, spread across Europe, Africa, and Latin America.

Warlock has already targeted organizations in the US, Brazil, India, Russia, Taiwan, and Japan, so the group is not focused on one specific region. The recent attacks on Portuguese- and Spanish-speaking countries could simply mean the attackers are looking for exposed and unpatched SharePoint servers wherever they can find them. They could also be working from a specific target list. Either way, targeting a water utility and a telecom company within a few weeks is something defenders should take seriously.

SharePoint is still the main entry point. Longlegs places a webshell in the LAYOUTS directory and designs it to work across different SharePoint versions. The attackers then steal the server’s ASP.NET machine keys and use them to create a signed payload that can execute code inside the SharePoint application. The technique is effective, but it depends on finding SharePoint servers that have not been properly patched.

Once they get inside, the attackers use DLL sideloading to run additional payloads. They download these files from legitimate hosting services such as catbox.moe and wasabisys.com, which helps the traffic blend in with normal activity.

Before deploying the ransomware, Longlegs also uses a signed but vulnerable driver called K7RKScan to disable security software. This is a common “bring your own vulnerable driver” technique. The attackers have also installed Visual Studio Code’s tunneling feature as a service, giving them remote access that can look like normal developer activity.

“The group continues to favor SharePoint-related vulnerabilities to gain initial access to targeted organizations.” states the report. “Longlegs abuses a vulnerable, signed driver (K7RKScan) to disable security software before deploying ransomware, and has also been observed abusing Visual Studio Code’s tunneling feature for covert remote access.”

Symantec’s report traces a full attack against a critical infrastructure operator starting July 22, 2026, when the webshell first landed on a SharePoint server. Two days later the attackers ran basic recon commands, deleted some staging files, and dropped a pair of DLL sideloading tools. A few days after that, they pinged a Burp Collaborator subdomain baked with the target’s own domain name, which is a scanner’s way of confirming its injected code actually ran.

By July 28 the real exploitation began, using a deserialization gadget to turn a forged, signed payload into code execution inside SharePoint. The attackers then pulled three separate installer packages from two different hosting services within ninety minutes, suggesting they had backups ready in case one path got blocked.

“Two different public hosting services and three distinct package names within the space of ninety minutes suggests the attackers had more than one payload ready to go and were not relying on a single point of delivery.” continues the report. “The intrusion then broadened from the two initial SharePoint servers to the wider domain. Later that day and into the next (July 29) the attackers repeatedly added a domain account named SPSEPRDSetup to the local Administrators group on three further hosts (Computer 3, Computer 4, and Computer 5):”

They spread out to more hosts by adding a fake-sounding admin account named SPSEPRDSetup, a decent bit of social camouflage since SharePoint really does create accounts with that kind of prefix.

On July 31, the attackers deployed a tool designed to disable antivirus and EDR across the network in a short period.

“In one intrusion against a critical infrastructure operator, the attackers pushed a tool designed to disable security software to at least 40 hosts within about two hours, then deployed Warlock on at least 33 hosts by staging it in the domain’s SYSVOL share, where ordinary domain replication delivered it to machines.” Symantec states.

Warlock ransomware was then deployed almost immediately after the security tools were disabled. This was not a slow attack. The attackers moved quickly from disabling protection to encrypting systems.

The attackers also used the domain’s SYSVOL share to distribute the ransomware. SYSVOL is automatically replicated across domain controllers, making it an effective way to spread files across a Windows domain. Symantec found that the ransomware was delivered through normal domain replication traffic, with three systems capturing dfsrs.exe, the Windows service responsible for that replication, delivering the malicious files.

The lesson here isn’t subtle. ToolShell and its related SharePoint flaws are still a working way into a network more than a year after they first made news, and that only holds true because some organizations haven’t patched or mitigated them yet. If you’re running on-premises SharePoint Server and haven’t checked it against CISA’s July 2026 advisory, that’s worth doing before your Monday coffee gets cold.

“Longlegs’ continued activity, more than a year after Warlock ransomware first came to prominence, shows that exploitation of ToolShell and other related-SharePoint vulnerabilities remains a viable initial access route for attackers SharePoint deployments that have not been patched or otherwise mitigated.” concludes the report. “The apparent recent focus on Portuguese- and Spanish-speaking countries suggests either an opportunistic targeting pattern driven by exposed, vulnerable SharePoint servers, or a more deliberate tasking. The inclusion of critical infrastructure operators among the victims is a reminder of the potential real-world consequences of ransomware attacks that succeed against essential services.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Warlock ransomware)

Cisco Talos details UAT-11587, a China-linked group using the Antino backdoor and Microsoft 365 as cover to spy on Asian governments.

Cisco Talos has been tracking a cluster of espionage activity since September 2025 that it calls UAT-11587, and by July 2026 the group had hit at least 16 government and policy organizations across eight Asian countries. The toolset includes a previously undocumented backdoor Talos named Antino, and the thing that makes it worth paying attention to isn’t how it gets in. It’s where it hides once it’s there.

Antino is written in Rust and works on both 32-bit and 64-bit versions of Windows. It supports the usual backdoor features, including shell and PowerShell access, file transfers, in-memory shellcode execution and persistence.

“Antino is a Rust-compiled Windows backdoor that supports host reconnaissance, shell and PowerShell execution, file transfer, in-memory shellcode loading and persistence. Its native command-and-control channel operates exclusively through Microsoft 365, using Microsoft Graph to interact with Outlook and OneDrive.” reads the report published by Talos.

None of these features are particularly new. What makes Antino different is how it communicates: instead of using its own command-and-control server, it uses Microsoft Graph to read commands from an Outlook mailbox and send stolen files to OneDrive. This allows its traffic to blend in with normal Microsoft 365 activity.

The attack starts in a more traditional way, with a convincing phishing email. UAT-11587 created highly targeted documents that suggest the attackers had researched their victims, including a fake workshop document about Taiwan’s information warfare and a document that closely copied a real Taiwan Ministry of Finance ruling about tax treatment for legislators.

“The document exactly reproduces a public Taiwan Ministry of Finance ruling to make the decoy appear credible.” conctinues the report. “Its subject strongly suggests that it was prepared for members of Taiwan’s public sector.”

In another case, the attackers reused a real Associated Press story about alleged Russian offers to the US over Venezuela. Matching malware samples appeared on VirusTotal two days after the original article was published.

The delivery trick is a simple but effective email spoofing technique that takes advantage of a gap many people overlook. The attackers sent the email through a legitimate provider, using one domain as the technical sender, while the visible From address showed the organization they were impersonating. SPF passed because the real sending domain was authorized, but DMARC detected the mismatch and failed. That still wasn’t enough to block the message. The impersonated domain had a DMARC policy set to monitoring rather than rejection, so the failed email still reached the inbox.

The Gmail trick is even more interesting. The attackers recreated Gmail’s normal attachment preview card almost pixel by pixel using images embedded in the email’s HTML. They then made the fake preview a link to a page controlled by the attackers. Open the email in Gmail and it looks just like the real thing because Gmail simply renders the HTML it receives. There is no exploit here. It’s just a very convincing copy of something users already trust.

From that click, a five-stage chain kicks in, leaning on legitimate-looking HTA files, Windows Script Host, and a scripted .NET deserialization trick that abuses a known gadget chain to load malicious code inside a trusted process. The final stage sideloads Antino through a signed Microsoft diagnostic binary, meaning the thing dropping the backdoor onto disk is a tool Windows itself trusts by default. Cloudflare Pages, R2, and Amazon CloudFront carried almost every stage of this, which kept the traffic blending into ordinary HTTPS the whole way through.

Once Antino is running, it checks its Outlook mailbox for new commands every ten seconds. The commands and results are sent as structured JSON hidden inside specially formatted email subjects.

“The Antino backdoor receives commands through email messages. The implant actively pulls commands from the threat actor’s Outlook mailbox folder every 10 seconds. The protocol uses two message types: command emails contain tasking from the controller, while response emails contain the implant’s results.” states Talos. “Command messages are identified by the subject prefix command_req_[session_id] and responses by command_res_[session_id], as indicated in the HTTP GET request sent by Antino: “

A separate system is used to upload stolen files to one OneDrive folder and download attacker tools from another. Even the naming makes the attacker’s perspective clear: “uploads” are files sent to the victim, while “downloads” are files pulled back from the victim.

The attribution case leans on accumulated small details rather than any single smoking gun, which is honestly how these assessments should work. Decoy document metadata carries Simplified Chinese language tags and a UTC+8 timestamp, a combination more consistent with mainland China than Taiwan or Hong Kong, where Traditional Chinese dominates. Separately, ten different Antino builds reference a Rust package mirror built specifically to speed up dependency downloads inside mainland China, the kind of tooling choice a developer picks for convenience, not for disguise.

The victim list reads like a checklist of what an intelligence service would actually want: defense ministries, legislatures, foreign affairs offices, border and interior security agencies, plus the think tanks and civil society groups that tend to know things governments care about early. Around 350 compromised endpoints turned up across eight countries, with the largest single wave, roughly 57 new endpoints, hitting India over two days in June. That’s not noise. That’s a deliberate and sustained collection effort.

“Based on the development, preparation-environment, and targeting indicators detailed in this report, Talos assesses with high confidence that UAT-11587 is China-nexus.” the report concludes.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Antino backdoor)

An AI-generated intelligence report falsely identified weapons on a Chinese ship, nearly triggering a US military operation during the Iran war.

According to CNN, four sources familiar with the episode say an intelligence report circulated through the military claiming a Chinese vessel in the Middle East was carrying components for a nuclear weapons program. The response was immediate. Armed boarding teams were preparing to move in, and military planes were already in the air.

“The intelligence report, circulated across the US military this spring in the midst of the war with Iran, immediately set off alarm bells: A Chinese ship in the Middle East was transporting components of a nuclear weapons program.” reads the report published by CNN. “The US military swung into action with plans to intercept the vessel, according to four sources familiar with the episode. According to two of the sources, armed members of the US military were preparing to board the ship. Military planes were in the air, one of those sources and another source familiar with the incident said.”

Then someone checked the source. The report was described by a source as “entirely false” and reportedly came close to triggering an armed operation, with the potential to escalate tensions between the US and China.

“The report, according to one of the sources, was “entirely false.” continues the report. “But it also “almost started a war,” the source said. Any US operation against a Chinese vessel could have risked spiraling into an armed conflict between the two nations.”

The incident began when an analyst at Special Operations Command Pacific asked a chatbot to analyze intelligence about the ship’s manifest. The system combined open-source information with classified signals intelligence and produced a wrong conclusion about the cargo. The analyst then used AI again to turn that conclusion into a formal intelligence report.

Two AI passes, zero verification in between. The case shows the real danger of AI hallucinations in military and intelligence work: a wrong answer can move quickly through the system when nobody stops to verify it.

“The internal tools are mostly just copies of the commercial stuff wearing lipstick,” a former senior US official familiar with the AI systems used by military and intelligence analysts told CNN.

Which matters, because the Pentagon has been pushing hard in the other direction. Defense Secretary Pete Hegseth’s January “Artificial Intelligence Acceleration Strategy” explicitly aims to put AI models directly into the hands of three million military and civilian personnel, across every classification level. The strategy talks about eliminating bureaucratic barriers and accelerating experimentation. Nobody in that strategy seems to have planned for what happens when the model is confidently wrong.

The way AI is being used across the military is still far from consistent. Different branches use different tools, follow different rules and apply different safety checks. There is also no common system for verifying whether the information produced by these tools is correct. According to one source, this was not an isolated case, and similar AI errors have already appeared elsewhere in the intelligence community.

The bigger problem may not be the technology itself, but the pressure to use it quickly. Younger analysts, who have grown up with AI tools, may be more likely to trust their answers without checking them carefully.

As one source put it: “AI allows you to get to a bad idea faster.”

That’s the whole risk, compressed into eight words. Speed was supposed to be the benefit. Instead it’s the thing removing the last checkpoint where a human might have paused and asked whether the machine actually got it right.

Targeting decisions are one of the most sensitive areas for military AI because they can determine who is attacked and who is not. The speed of AI can become a problem when there are not enough checks to verify its conclusions before action is taken.

One source noted that there is still no clear guidance on how a human operator should prevent civilian casualties or friendly-fire incidents when AI is heavily involved in selecting targets. The biggest risk may not be an AI system acting on its own, but a confident and incorrect answer reaching decision-makers before anyone has time to challenge it.

In military operations, speed matters, but so does having someone able to stop and ask a simple question: is this information actually correct?

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Hallucinations)

Hunt.io links SpiceRAT, NodeEdgeRAT and NomadRAT to a four-year SilkParasite campaign targeting governments and critical sectors in Central Asia.

Hunt.io and researcher Guy Yasur have traced a tight cluster of SpiceRAT command‑and‑control servers that predate and extend Bitdefender’s August 2026 SilkParasite report. The work doesn’t dissect malware samples; it maps the network side of the operation with enough precision to tie three of SilkParasite’s seven RAT families (SpiceRAT, NodeEdgeRAT, and NomadRAT) through shared certificates, domains, and hosting patterns.

“Shared parent domains and an identical TLS certificate connect this infrastructure to hosts Bitdefender attributed to SpiceRAT, NodeEdgeRAT, and NomadRAT, three of the seven malware families documented in the SilkParasite report.” reads the report published by Hunt.io.

“The certificate imitating the Uzbekistan railway entity was issued by TLC, a certificate authority wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology.”

In March 2026, Hunt.io identified five SpiceRAT command-and-control servers hosted by different providers and in different countries. Researchers linked them through several common elements, including the same hostnames, TLS certificates, and a cloned webpage used as the default page.

Instead of focusing only on the malware itself, this approach looks at the infrastructure behind it. Shared certificates or identical webpage hashes can provide strong and practical indicators that defenders can use to identify other servers linked to the campaign.

One certificate in particular stands out. It impersonates Uzbekistan’s state railway authority (azure.uzrailwaystax[.]com) and was issued by TLC DV TLS CA, a CA wholly funded by CAICT, a Chinese state research institute under the Ministry of Industry and Information Technology. The issuer alone isn’t an indicator—nearly 3,000 servers host TLC certificates—but a domain‑validated cert spoofing a Central Asian state entity from a China‑based CA does suggest a deliberate procurement channel.

Requests to ns2.asiainfo.it[.]com on 188.190.29[.]126 returned a full copy of RTX Corporation’s homepage, complete with navigation, subsidiary links, and a stock ticker. The page contained no malicious code and wasn’t unique to that server, but its reuse across the cluster made it a powerful fingerprint.

“Hunt.io’s C2 Infrastructure module tracks servers matching detection signatures for known malware families, including SpiceRAT. In mid-March 2026, we observed a cluster of five active SpiceRAT servers: 46.30.191[.]230, 188.190.29[.]126, 193.29.59[.]159, 31.58.220[.]250, and 171.22.16[.]187. The five were active together in mid-March 2026, across multiple hosting providers and countries.” continues the report.

A HuntSQL query on the page’s SHA‑256 hash returned exactly 13 hosts; three were already in Bitdefender’s SpiceRAT list, two more matched Hunt.io’s SpiceRAT signature, and the remaining eight extended the footprint through shared nginx versions and the same static page.

Why RTX? The report offers two plausible explanations: the page rendered cleanly and was grabbed as a convenient template, or it reflects shared tooling where the clone functions as a default deployment asset. Either way, for defenders it’s a low‑noise, high‑precision signature: byte‑for‑byte identical wherever it lands.

Bitdefender’s SilkParasite report treated several RAT families as distinct, but Hunt.io’s network view shows they share parent domains and certificates. For example, help.hoster‑kg[.]com (on 193.29.58[.]192) presented the same railway‑spoofing certificate, while Bitdefender attributed evo.hoster‑kg[.]com to NodeEdgeRAT; the two are linked through shared registration of hoster‑kg[.]com, not a shared server. Similarly, kg.tdtu[.]org shares a parent domain with mineconom.tdtu[.]org, a NomadRAT C2 indicator in the SilkParasite report.

This doesn’t prove a single operator, but it does show a support function or toolset shared across the campaign. From a detection standpoint, it means pivoting on domains, certificates, and hosting profiles can surface nodes that sample‑based analysis would miss.

The cluster’s domains don’t just look governmental; they spoof specific ministries and state enterprises. Examples include help.galkynysh[.]net (Galkynysh gas field, Turkmenistan), tmgaz‑server[.]com (Türkmengaz), tm‑mfa[.]com (Turkmenistan’s Ministry of Foreign Affairs), and tojiktelecomtj[.]com (Tojiktelecom, Tajikistan). Additional domains impersonate Turkmen energy (sanly.oilgas‑tm[.]com), Uzbek administration (azure.adm‑devon[.]com), and even the Kyrgyz president’s residence (data.yntymak‑ordo[.]com).

Bitdefender’s targeting came from lures and infection telemetry; Hunt.io’s infrastructure analysis names the same sectors with concrete entities. Passive DNS and subdomain enumeration push the timeline back to mid‑2022, suggesting this isn’t a new campaign with a fresh brand—it’s a longer‑running operation now labeled SilkParasite.

SilkParasite overlaps with FamousSparrow, a suspected China‑nexus actor previously seen targeting hotels, governments, and international organizations. The infrastructure also mirrors IndigoZebra (Speccom), documented by Check Point in 2021 as targeting Central Asian ministries with similar domain patterns (mail, service, help) and overlapping naming conventions. These parallels don’t settle attribution, but they do reinforce a consistent operational style across China‑nexus activity in Central Asia.

If you’re responsible for OT/ICS, telecom, or government networks in the region, start by checking your edge and DMZ for the indicators below, especially the RTX page hash and the railway‑spoofing certificate. Monitor for high‑numbered RDP‑over‑TLS ports (64350, 64330, 65535, 65111) on the ASNs most prevalent in the cluster, and watch for domains impersonating local hosting providers or state entities. The original Hunt.io post includes the full IoC tables and HuntSQL queries; linking to it is essential for precise awareness and for teams that want to reproduce the pivots.

“The targeting picture that emerges from this infrastructure, named ministries and state enterprises across five Central Asian countries dating back to at least mid-2022 suggests SilkParasite is a more recent label for an operation with much longer and wider footprint.” concludes the report. “Organizations in the affected sectors and regions can make use of the above indicators and observations to assess their own exposure.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SilkParasite)

China is emphasizing technical controls for AI agents as U.S. leaders debate slowing frontier AI, raising new questions for businesses deploying autonomous systems.

The post China’s Answer to AI Safety: More Controls, Not Slower Development appeared first on TechRepublic.