Four espionage groups used the BlueMoon Chrome+Windows exploit kit within 12 days. Researchers suspect AI development.

Proofpoint published a detailed analysis of a Chrome-and-Windows exploit kit it tracks as BlueMoon that four nation-state actors adopted within roughly two weeks of the first observed use. Google’s Threat Intelligence Group, Microsoft’s MSTIC, and Volexity all contributed to the investigation.

“Proofpoint identified four espionage-motivated threat actors employing a new exploit kit that chains multiple Chrome browser and Microsoft Windows vulnerabilities. Proofpoint is tracking the exploit kit used in this activity as BlueMoon.” reads the report published by Proofpoint. “The first observed cluster using the BlueMoon exploit kit was the China-aligned threat actor TA412 (JungleBamboo, Violet Typhoon, APT31, TIDE CASTLE) on 28 August 2026. Within days, several other espionage-motivated clusters began using BlueMoon, the majority of which have a suspected China nexus. However, BlueMoon may not be exclusive to China-aligned actors, as some usage remains unattributed and there are also potentially more actors using the exploit kit.”

BlueMoon chains three vulnerabilities. CVE-2026-85046 is a type-confusion bug in Chrome’s V8 JavaScript engine that abuses an optimization flaw in the TurboFan JIT compiler: by mutating an array mid-sort, an attacker gets the ability to read object memory addresses and forge fake object pointers, building toward arbitrary read and write inside V8’s heap. A V8 sandbox escape (no CVE assigned, Chrome doesn’t issue CVEs for sandbox escapes) then overwrites WebAssembly compiled function bodies with attacker shellcode from memory. CVE-2026-85880, a Windows kernel local privilege escalation using ALPC and Windows Notification Facility mechanisms, completes the chain and elevates the attacker from the browser’s sandboxed renderer to a position where they can inject code into Chrome’s parent process and run arbitrary commands.

“Both V8 vulnerabilities were “patch-gap” zero-days at the time of the observed activity. In other words, while they were known vulnerabilities already fixed in public upstream Chromium source code, they remained unpatched in the latest stable releases of Chrome and Chromium-based browsers available to the public.” continues the report. “It is likely that the exploit kit developer used these publicly available Chromium patches to weaponize the browser exploit chain.”

The fix for CVE-2026-85046 was committed to the Chromium source tree on August 7, almost four weeks before it rolled into the stable Chrome release on September 3. That gap is what made rapid weaponization possible: the patch itself is a public document describing exactly what was wrong.

The kit also bears visible signs of how it was made.

“Although no single artifact conclusively confirms AI-assisted development of BlueMoon, Proofpoint identified several indicators consistent with this hypothesis, including extensive diagnostic logging capabilities, a referenced markdown handover document, and detailed comments documenting successive debugging iterations and implementation decisions.” states the report. “Furthermore, the exploit chain’s default configuration reflects a departure from the level of operational security and technical tradecraft typically associated with browser exploit chains. For example, by default, successful exploitation simply results in a curl command that downloads an actor-provided executable to disk and executes it. “

The comments in the kit ask testers to “please send the full log back.” It also refers to a markdown handover file, docs/v8-ctf-chrome-stage4-handover.md, which could be used to pass context between AI agent sessions. The kit repeatedly mentions Google’s V8CTF vulnerability bounty program. Proofpoint says this could mean the V8 bugs were developed through that program, or that the developers used the V8CTF context to get around AI safety restrictions while creating the exploit. The researchers cannot confirm which explanation is correct.

The default post-exploitation step is another important clue. The kit includes a complete Chrome exploit chain that can escape the V8 sandbox and gain higher privileges on Windows. Its default payload uses curl to download an executable into %TEMP% and run it. Endpoint security tools would likely detect this activity quickly. This suggests the developers focused on releasing the exploit before the September 3 Chrome patch rather than making it difficult to detect.

The first confirmed use was TA412 (aka APT31, Violet Typhoon, and JungleBamboo) a China-nexus APT linked to the Ministry of State Security’s Hubei State Security Department and indicted by the US government in 2024 for economic espionage. Starting August 28, TA412 targeted US NGOs, mining companies, and physical commodity trading firms using phishing emails that posed as university students seeking internships or as outreach related to the Association for Asian Studies conference. Clicking the link loaded BlueMoon silently, then redirected the browser to a legitimate site while exploitation ran in the background.

TA412’s post-exploitation payload was GemStone, a malicious browser extension that masquerades as an “AI-powered browsing companion by Google Gemini.” It installs into Chrome, Edge, Brave, and Vivaldi by bypassing the browser’s Secure Preferences protection mechanism using the same HMAC computation method the browser itself uses to validate extensions.

GemStone accepts commands to capture keystrokes, cookies, screenshots, local and session storage, and browsing history, and can inject arbitrary HTTP requests from the browser’s own context. It runs its C2 through a Cloudflare Worker domain. Proofpoint has the full command table in the report.

On September 2, UNK_LateNight, a second suspected China-aligned cluster, began targeting US aerospace and defense companies with fake RFQ and procurement inquiry emails. The payload was ShadowPad, the modular backdoor extensively used by Chinese state groups, delivered through a DLL sideloading chain that creates a scheduled task named “EdgeCore_AutoUpdate” for persistence and unhooks 20 network monitoring functions to reduce visibility. The same day, UNK_DoubleCheck targeted a Vietnamese manufacturing company from a compromised Southeast Asian government email address with a vaccination appointment lure. Its payload downloaded a Rust-based loader from Cloudflare R2 that staged a second DLL sideloading chain for C2.

Since September 3, UNK_QuietRacket has targeted government, consulting, and financial organizations in Indonesia and Singapore with conference-themed lures. Its C2 uses Google’s DNS-over-HTTPS service to resolve addresses through TXT records, then decrypts them with ChaCha20 before reaching Cloudflare Workers. DoH hides the DNS activity among normal encrypted traffic, making the C2 harder to detect.

CVE-2026-85880, the Windows LPE component of the chain, is the same vulnerability Microsoft patched as an actively exploited zero-day in September 2026 Patch Tuesday. The Windows LPE only targets older builds, including Windows 10 through 22H2, Windows Server 2019 and 2022, and Windows 11 21H2. Its compilation timestamp is from 2025, suggesting it was a pre-existing capability packaged into BlueMoon rather than written for this campaign.

Defenders running those builds who haven’t applied September patches should treat this as urgent regardless of whether they’re a BlueMoon target.

“A fully weaponized Chrome exploit chain has historically been a high-value, rare capability. BlueMoon was developed, deployed rapidly, and shared across multiple threat actors within days in a manner that had high detection signals. This may reflect a reduced cost and barrier to entry for this class of capability, as AI agents increasingly enable threat actor exploit development. This is particularly relevant for open source codebases, such as Chromium, where upstream patches are publicly accessible prior to downstream consumers of the codebase applying the patch. This creates a window for threat actors to attempt to rapidly reverse engineer patches and develop exploits ahead of downstream stable releases.” concludes the report. “The majority of observed BlueMoon usage is assessed to be China-aligned espionage-motivated activity, although there is not sufficient evidence to attribute BlueMoon usage exclusively to China-aligned threat actors at the time of writing.” 

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, BlueMoon)

US agencies accuse six Chinese AI firms of extracting billions of tokens from US AI models to accelerate development and copy advanced capabilities.

NSA, CISA, and the FBI jointly published an advisory accusing six Chinese AI companies, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI, of running industrial-scale extraction campaigns against US frontier models since at least late 2024. The framing is deliberate: this isn’t a footnote to how these companies build AI, the agencies call it the core of their entire development strategy.

Distillation is a legitimate and widely used technique. It involves training a smaller AI model to reproduce the answers and capabilities of a larger one. But the advisory says the activity it uncovered went much further. It alleges that the companies sent millions of requests to models such as Claude, GPT, Gemini, and Grok and extracted billions of tokens.

“China-based artificial intelligence (AI) companies are conducting systematic extraction of proprietary functionalities and capabilities of U.S. AI companies’ models through industrial-scale knowledge distillation campaigns that form the core—not merely a supplement—of their AI development strategy.” states the report. “Likely with Chinese government awareness, DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models, including variants of Claude, GPT, Gemini, and Grok, since at least late 2024.”

The goal was to capture valuable capabilities, including reasoning, coding, and agentic skills that took years and huge amounts of computing power to develop.

The advisory provides the most detail about DeepSeek. It claims the company ran an organized campaign against different versions of Claude, GPT, and Gemini between late 2024 and mid-2025 to help develop its R1 and V3 models. The extracted data reportedly included specialized knowledge, such as legal expertise, as well as chain-of-thought reasoning.

“Advanced industrial-scale distillation tactics include chain-of-thought (CoT) reasoning extraction, automated failover between pathways during blocking attempts, and sophisticated quality evaluation frameworks to detect defensive countermeasures. China-based AI companies that conduct industrial-scale distillation against U.S.” continues the advisory. “AI models see significantly shorter AI development timelines and reduced financial expenditures in training a frontier model.”

This is particularly significant because AI companies usually limit access to a model’s internal reasoning. Getting a model to reveal those steps could therefore give attackers much more than just its final answers.

Moonshot AI’s alleged operation shows how fast these campaigns can move once new models ship. The advisory states the company redirected its extraction traffic to a newly released Claude model within 24 hours of launch, which only works if you already have infrastructure sitting ready and monitoring provider releases in real time. That’s not opportunistic scraping; that’s a standing operation built specifically to capture whatever comes out next.

The methods described in the advisory suggest a highly organized operation rather than researchers simply making API requests. The companies allegedly bought large numbers of premium accounts and shared them among teams of developers running many sessions at the same time. They also routed traffic through gray-market proxy services, which the advisory calls “transfer stations,” to remove identifying information and avoid detection. StepFun reportedly used pools of accounts and automated systems to spread requests across them, helping bypass rate limits and increase daily spending as the operation grew.

The advisory also describes attempts to manipulate the AI models themselves. MiniMax allegedly used prompt injection to convince Claude Code that it was actually a MiniMax product, hoping to make it behave differently. While this detail may sound unusual, it shows how far some of these efforts reportedly went to extract information from competing AI systems.

The advisory doesn’t just name and shame, it lays out concrete detection signals for US AI companies to watch for. Shared accounts logging in from multiple IPs and user agents, usage running 24/7 without the natural idle periods a human would produce, subscription-to-API-usage ratios that don’t add up, and brand-new accounts hitting maximum usage immediately instead of ramping up gradually the way legitimate adoption normally does.

We must consider that any one of those signals alone might be nothing, but the agencies are betting the combination is a fairly reliable tell.

“China-based AI companies leverage techniques not in MITRE ATLAS, demonstrating significant organizational investment, operational maturity, and adaptive capability development distinguishing these campaigns from opportunistic exploitation.” added the advisory.

The recommended countermeasures get genuinely aggressive, and one in particular is worth sitting with. The advisory suggests quietly serving degraded, less capable responses to accounts suspected of running distillation campaigns, without ever telling those users their access has been downgraded, specifically so they can’t adjust their extraction technique in response. That’s a notable policy stance from a government advisory: not just detect and block, but actively deceive suspected bad actors about the quality of what they’re receiving.

Whatever the geopolitical debate, the practical lesson for companies using frontier AI models is clear. If several employees share enterprise AI accounts, providers will likely monitor usage more closely for the patterns described in the advisory. Heavy legitimate use could sometimes trigger false positives, especially when organizations have many developers making large numbers of requests at the same time.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Models)

Hunt.io uncovered a Chinese-speaking campaign using AI agents to automate cyberattacks against Asian government, education and industrial targets.

Threat intelligence firm Hunt.io just documented a second, separate China-linked campaign wiring commercial AI models directly into live cyberespionage operations, this time hitting Taiwan’s Kuomintang Party archives, Indonesia’s Ministry of Foreign Affairs, government and education systems in mainland China, and industrial hosts in Vietnam.

The full report traces the operation through five exposed open directories the operators accidentally left publicly accessible, which is how researchers reconstructed the entire orchestration system from the inside.

“Five open directories, one campaign. The exposed directories map to an AI orchestration host, a Java/CAS exploitation workspace, a fake MySQL deserialization service, a Shellshock and credential-testing node, and a payload-distribution store.” reads the report. “SecFlow split reconnaissance, exploitation, collection, and reporting among specialist workers. The runtime could switch between Claude, Qwen, and DeepSeek profiles without changing the task interface.”

The framework behind the campaign, called SecFlow by the operators, could use different AI models, including Claude, Qwen, and DeepSeek. The operators could switch between them without changing how the system worked. Instead of using the models’ official APIs, SecFlow routed requests through private proxy servers linked to the niestools.com domain.

The AI models did not break into systems on their own. They helped automate and organize traditional hacking tasks, such as scanning for vulnerabilities, testing stolen credentials, trying exploits, deploying webshells, collecting data and evidence, and generating reports. The attackers built the infrastructure that connected these AI capabilities to real-world intrusions.

The most damaging confirmed breach hit a Fengtai District government Office Automation environment in China, and it ran the full playbook from web shell to data theft.

“The most extensive compromise hit a Fengtai District government environment, where the operator achieved command execution, collected LSASS and registry hives, accessed government and health records, and deployed multiple Windows implants. Separate activity exposed a Chinese education AI platform and obtained root database access to a university campus-card system.” Hunt.io states. “SecFlow coordinated reconnaissance, exploitation, and reporting across Claude, Qwen, and DeepSeek workers. “

Operators achieved Windows command execution through internet-facing web applications, then used ASPX web shells not just to run commands but as a persistent operational backbone: querying internal databases, pulling an LSASS memory dump apart in 37 separate chunks to avoid detection, and extracting SAM and SYSTEM registry hives containing password hash material.

“The operator divided the LSASS dump into 37 blocks, requested each block through an authenticated SOCKS route, verified the expected byte count, and reconstructed the complete file.” continues the report. “The operator also collected the SAM and SYSTEM registry hives. Another server-side page, extract.aspx, scanned sections of the memory dump for Windows password-hash material.”

From there they pulled 822 OA user account records, created a new privileged account of their own for backup access, and walked away with 949 attachments totaling 1.28GB, including a chronic-disease report containing real patient health information.

In a separate case, the operators also exposed the management backend of a Chinese education AI platform. The irony is hard to miss: an AI company was compromised partly because its own AI infrastructure was not properly secured.

Hunt.io found a backend that anyone could access without authentication. It exposed 23 AI agent configurations, 14 API secret fields containing credentials, and 104 complete chatbot conversations. Some of those logs included real student data, such as names, student ID numbers, majors and academic advisers, taken from career-guidance and study-partner chats.

The exposed credentials were not just old or unused secrets. They worked against the platform’s live production API, meaning attackers could use the stolen keys to access real systems.

One particularly clever access method used a fake MySQL server as bait rather than a target. A malicious service impersonating a MySQL database would accept connections from vulnerable Java applications, then return specially crafted data designed to trigger unsafe object deserialization on the client side the moment it connected, turning what should have been an outbound database query into inbound code execution. That’s initial access flipped on its head, exploiting the assumption that connecting out to a database is inherently safer than accepting connections in.

The webshell tooling itself, a custom framework the operators called GLUTTON, hid its payloads inside PNG image files using steganography, literally embedding executable code in the red, green, and blue color channel data of ordinary-looking images. A small decoder script on the server would read the image pixel by pixel, XOR-decrypt the hidden bytes using a fixed key, and load the resulting code directly into memory without ever writing an obviously malicious file to disk. Any security control that only checks file extensions or content types for image uploads would sail right past this without noticing anything wrong.

This isn’t an isolated incident for the underlying pattern either. It’s the second campaign in two months where researchers caught commercial AI coding tools embedded as operational components of live nation-state intrusions, following a similar Hunt.io discovery in June involving the same Claude Code and DeepSeek combination against separate government and financial targets in Afghanistan and Thailand. Anthropic itself disclosed a related pattern back in November 2025, describing attackers who convinced Claude it was doing legitimate defensive penetration testing by splitting malicious requests into small, individually harmless-looking pieces.

The operators also left a clear trace across their own infrastructure. The username “Nie” appeared several times in hardcoded file paths inside the GLUTTON tools and was reused in proxy credentials, linking all five compromised workspaces to the same campaign.

For defenders, this is especially important if they use Java frameworks vulnerable to deserialization attacks, older Apache or Grafana systems, or public-facing office automation software. The campaign shows that attackers can treat commercial AI models as interchangeable tools. The key question is no longer which AI model carried out an attack, but how quickly defenders can recognize the attack pattern, regardless of which model was used.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

Fire Ant hijacked Cisco routers, stole credentials and altered logs to hide its tracks, using trusted infrastructure to reach high-value networks.

Chinese-linked cyber espionage group Fire Ant has spent the past year quietly graduating from hacking individual computers to hacking the infrastructure that connects them. Sygnia’s new report traces how the group expanded from compromising hypervisors into routers, authentication servers, and Linux management hosts, the unglamorous plumbing that decides who gets to log in where and what gets recorded when they do.

The investigation started with something that looked like a minor configuration mistake. A tunnel interface showed up as active on a Cisco IOS XR router with no corresponding entry in the configuration history, no commit anyone could point to that explained how it got there.

“The investigation began with an anomaly that appeared, at first, to be a configuration inconsistency: a tunnel interface became operational on a Cisco IOS XR router even though no corresponding running configuration or commit history could explain its creation. The interface was associated with a specific VRF and used GRE encapsulation, but standard configuration review did not provide a reliable explanation for how it appeared.” reads the report. “This discrepancy became a key investigative lead because it suggested that the device’s operational state could no longer be trusted to match the configuration and audit records visible to administrators.”

That single inconsistency became the thread that unraveled the whole operation, because it meant the router’s own records could no longer be trusted to reflect what the device was actually doing.

What Fire Ant built inside that router wasn’t generic malware bolted onto Linux. The toolkit was purpose-written for IOS XR’s own internals, hooking into logging, command execution, and routing functions directly. One component disguised itself as a legitimate boot service and ran on a bizarre schedule, active only during odd-numbered hours and shut off during even ones, apparently timed to dodge routine inspection windows. Another modified the router’s own syslog function so that any log message not containing the word “Health” would silently vanish instead of being recorded, a filter so specific it reads like something built to survive a very particular kind of audit.

Following that anomalous tunnel led investigators to a second compromised machine, an aging Linux system acting as the tunnel’s far end. From there, Fire Ant wasn’t just maintaining access, it was actively scanning outward toward other high-value networks, probing SSH, RDP, and web ports on systems connected through the compromised infrastructure.

“The actor appeared to use the compromised environment as an infrastructure platform from which it could explore reachability into connected high-value networks, including critical infrastructure.” states Sygnia. “In this model, routers, TACACS servers and jump hosts are not peripheral assets. They are the path to the target behind the target.”

The authentication layer got its own dedicated attack, and this is the part that should concern anyone who thinks compromised credentials are the worst-case scenario. Fire Ant injected a malicious library directly into a running TACACS authentication daemon, the software responsible for approving administrator logins across network devices, then intercepted live sessions as they were accepted and quietly copied the credential material flowing through. That’s not stealing a password from a phishing page; that’s sitting inside the process whose entire job is deciding who to trust, watching every legitimate login happen in real time.

“The acpid component embedded a modified IOS XR syslog library. In the modified evsyslog flow, log delivery was routed through a custom wrapper that checked for the string “Health” before calling mq_send. When the condition was not met, the wrapper returned a success-like value without forwarding the message, indicating selective manipulation of router log delivery.” states the report.

Fire Ant also used deep, persistent backdoors on Linux systems. Some had remained dormant since 2025 and were disguised as normal system services, making them easy to overlook. One even posed as SentinelOne’s security agent and stayed active in memory after its file was deleted, making standard disk-based forensic checks ineffective on their own.

Perhaps the most technically distinctive piece was a backdoor that didn’t listen on any port at all in the conventional sense. Instead it silently inspected raw network traffic, waiting for specific packets carrying an embedded magic string before it would activate and open an interactive shell. This design shares real code-level overlap with tooling publicly tied to UNC3886, a China-nexus espionage cluster Google and Mandiant have tracked for years, though the specific activation strings and packet-handling logic here differ enough from earlier public reporting that Sygnia treats it as an evolution rather than a straight reuse.

“The key choice is notable because Mandiant previously documented UNC3886 TACACS credential-collection tooling in which captured credential records were also XORed with 0xEF before being written to a credential log file.” continues the report.

Once inside, Fire Ant didn’t just avoid detection, it actively edited the evidence. Login records in Linux’s own wtmp, utmp, and btmp files got rewritten to swap out the router’s real IP address for an internal one, and sudo-related entries were stripped from system logs to erase any trace of privilege escalation. Sygnia’s core warning for defenders cuts against a habit most incident responders have built their careers on: logs are not automatically ground truth anymore, and any investigation into infrastructure this deeply compromised has to cross-check log evidence against memory, disk state, and network telemetry independently rather than trusting any single source on its own.

The bigger concern is that Fire Ant was not mainly interested in the systems it first compromised. It used them as a stepping stone into more valuable networks connected through trusted routing and authentication relationships — what Sygnia calls the “target behind the target.” This means edge routers, TACACS servers and Linux jump hosts can be just as important to protect as systems holding sensitive data, especially when they connect to critical infrastructure. These often-overlooked systems can give a patient and well-resourced attacker a trusted path deeper into the environment, making them a valuable target rather than an unimportant middle layer.

“The central lesson is that defenders must protect more than the systems that store sensitive data. They must protect the infrastructure that makes other systems reachable, trusted, and observable.” concludes the report. “When that layer is compromised, the impact extends beyond a single organization: the actor may gain a vantage point for collection, a path toward connected targets, and the ability to make trusted infrastructure tell an incomplete story.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Fire Ant)

An alleged Chinese-speaking actor breached Philippine nuclear and naval targets by exploiting known flaws, stealing sensitive data.

A suspected Chinese-speaking operator targeted a Philippine nuclear research body and a marine engineering company that supports the Philippine Navy, using well-known vulnerabilities in internet-facing ownCloud and WordPress systems. The activity was uncovered after Hunt.io found an exposed server in Amsterdam that contained attack scripts, logs, offensive tooling and data taken from the two organisations.

“Hunt.io Attack Capture discovered an open directory containing tooling which documented intrusion activity against two Philippine organizations.” reads the report published by Hunt.io. “A recovered CSV references roughly 9 GB of material stolen from the nuclear agency, most absent from the current directories contents, and a compromise of a project management application, indicating a possible third victim.”

Hunt.io disclosed the findings to CERT-PH under the TLP:AMBER sharing standard and delayed publication until 25 August 2026 so the national response team could notify the affected organisations. The incident arrives amid sustained tensions in the South China Sea and continuing reports of suspected Chinese cyber activity against Philippine government, defence and critical-infrastructure targets.

“On August 13, 2026, Hunt.io Attack Capture identified an open directory on the host 31.58.209[.]241. The server staged custom Python scripts, per-file transfer logs, open-source offensive security tooling, and exfiltrated data from two Philippine organizations. The scripts targeted an ownCloud instance operated by a nuclear research body, using pre-signed URLs generated with an empty signing secret, which allowed for the unauthenticated retrieval of files over WebDAV.” states the report.”A separate intrusion was observed exploiting a WordPress site operated by a Philippine marine engineering and shipbuilding company that provides services to the Philippine Navy.”

The server was not a sophisticated hidden service. It exposed a Python SimpleHTTP directory on port 8000, along with SSH, a self-hosted ownCloud login page and other services. The directory contained 1,310 files in 86 folders, totaling 1.17 GB, including scripts, stolen data and tools such as Sliver, Metasploit and Mettle.

Researchers gained a rare view of the attacker’s operations after finding tools, logs and stolen files left exposed on the server. The main entry point was likely the nuclear research body’s internet-facing ownCloud service, compromised by exploiting CVE-2023-49105, an authentication-bypass flaw in ownCloud versions before 10.13.1.

In this condition, an attacker who knows a valid username can generate WebDAV requests that the server accepts as if they were made by that user. No password is needed. Hunt.io found five custom Python scripts implementing this technique, four focused on individual accounts and a fifth capable of enumerating directories and recording every attempted download. hunt

“In vulnerable instances when no such key was configured, a default state on new installs, the signing routine still executed using an empty secret. An attacker with knowledge of valid usernames on the instance could construct signed WebDAV requests that would be accepted by the server as authentication action by that user, without ever supplying credentials.” continues the report. “A total of five custom Python scripts saved from the directory implement this exact technique described above. Four target a single account each; the fifth moves further to include directory enumeration and logging.”

The attacker used random delays to make data collection less noticeable and avoid volume-based alerts. Scripts, logs and folders consistently used Simplified Chinese, including labels for nuclear, radiation-safety, finance and IT files. This suggests a Chinese-speaking operator, but does not prove links to a specific government or threat group.

The stolen data included nuclear reactor component databases, fuel inventories, radiation-safety documents, incident records and authorised-user lists. It also included strategic plans, IT documents, staff records, CVs, passport and travel data, and financial disclosures from Philippine officials.

The exposed server held 176 files, about 372 MB in total. However, a CSV created by the attacker referred to roughly 9 GB of stolen data. This gap suggests the server contained only part of the haul and that the attacker may have accessed much more than researchers could recover.

The material also included a KeePass database, AxCrypt-encrypted files and a BitLocker recovery key. Those artefacts matter because they can support follow-on access: a data theft operation can become a credential-theft operation, and a credential-theft operation can become a longer-term intrusion.

Researchers additionally recovered a 192 MB SQL dump from a ZKTeco BioTime attendance and personnel system. Such a database can link people to badge identifiers, departments and access records, enabling an attacker to build a picture of who works where, who may have sensitive access and which people are worth targeting next.

The same server also contained evidence of a breach involving a Philippine marine engineering and shipbuilding company that works with the Philippine Navy. The attacker exploited CVE-2024-28000, a privilege-escalation flaw in the LiteSpeed Cache WordPress plugin.

The flaw let attackers create a WordPress admin account without authentication by exploiting a predictable security hash through the REST API. Hunt.io found the exploit code, compiled tools and logs showing that the attacker successfully gained admin access.

The attacker also used WordPress XML-RPC to test passwords for the admin account with the well-known rockyou.txt list. The logs show that this method also found valid credentials.

That gave the operator redundancy. Even if one access path were closed, the attacker could retain an administrator account, a valid password or data such as WordPress hashes and secret values from the stolen site database. Redundant access is not glamorous. It is, unfortunately, effective.

While examining the compromised WordPress site, Hunt.io also discovered an active EtherHiding-style injection that it believes may be unrelated to the Chinese-speaking operator. The malicious JavaScript used an Ethereum smart contract as a place to retrieve content, then displayed a fake Google verification page designed to push visitors into a ClickFix-style infection flow.

The campaign used a service worker for persistence and collected visitor fingerprint data. Hunt.io found 174 unique IP addresses hosting pages with the same NoChain loader strings and smart-contract reference, but said the evidence did not link that activity to the operator who attacked the nuclear and naval-linked targets.

That distinction matters. A compromised website can host multiple intrusions or payloads at once, often run by unrelated actors. Analysts should resist the temptation to treat every malicious artefact on one server as evidence of a single campaign.

The technical lesson is blunt: old and known weaknesses still provide access to high-value targets. Organisations using ownCloud should upgrade to version 10.13.3 or later, apply the vendor’s relevant fixes and ensure that pre-signed URLs use a strong, non-empty signing key.

Teams should also examine WebDAV logs for suspicious PROPFIND directory-enumeration requests, large volumes of file retrieval across multiple accounts, or recurring requests from a single source with artificial gaps between them. Low-and-slow collection is still collection.

For WordPress, organisations should update LiteSpeed Cache to version 6.4 or later, remove or restrict XML-RPC when it is not needed, enforce strong unique administrator passwords and require multi-factor authentication. The XML-RPC compromise in this case succeeded against a password from a public wordlist, which is not a vulnerability in WordPress so much as an invitation nobody should leave on the doorstep.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Philippine nuclear and naval targets)

FBI seizes QScan and QTRouter, China-linked platforms used to hide intrusions and target U.S. critical infrastructure.

The U.S. Department of Justice and the FBI have seized two platforms, QScan and QTRouter, used by a China-linked group to hide cyberattacks and target critical infrastructure. The operation matters because it shows how state-backed actors no longer need to build every part of an attack from scratch: they can rely on shared scanning tools, compromised devices, commercial proxy services, and rented servers.

U.S. authorities attribute the activity to a group known as QTFY, which they say operated through the China-based company Nanjing Xinjiuwei Network Technology Company. According to the Justice Department, the group offered hacking services to paying clients that included China’s Ministry of State Security and the People’s Liberation Army.

“The Justice Department and FBI announced court-authorized domain seizures today to deny malicious cyber actors access to two complementary hacking platforms known as “QScan” and “QTRouter,” used to target U.S. critical infrastructure and other sensitive networks. As described in court documents unsealed in the Southern District of California, a People’s Republic of China (PRC) state-sponsored group known as “QTFY,” employed by China-based Nanjing Xinjiuwei Network Technology Company (南京鑫玖维网络科技有限公司), created and operated QScan and QTRouter.” reads the press release published by DoJ.

According to the Justice Department, QTFY targeted NASA, the Federal Reserve, the Departments of Energy, Justice, and Health and Human Services, the National Institutes of Health, and the U.S. Senate. Those are not random targets caught in a broad scan.

QScan and QTRouter had different jobs. QScan searched the internet for vulnerable devices and automatically infected thousands of exposed Internet of Things devices. Those compromised routers, cameras, appliances, and other connected systems were then added to QTRouter, a proxy network used to route malicious traffic through systems located outside China.

That approach makes attribution and blocking harder. A victim may see an attack coming from what appears to be a local router, a legitimate commercial proxy, or a virtual private server rented in another country. Blocking traffic by country or IP address becomes far less useful when the attacker is borrowing the identity and location of other people’s devices.

“QScan scans and automatically infects thousands of “internet-of-things” (IoT) devices worldwide, which are then added to the QTRouter network of QTFY-controlled devices. QTRouter consists of these compromised IoT devices, as well as commercial proxy service devices and leased virtual private servers.” continues DoJ. “QTRouter then serves as an “obfuscation network” – meaning it allows QTFY and other malicious cyber actors to conceal the PRC-origin of their computer intrusion activities because the malicious communications appear to originate from computers (such as those compromised by QScan) that are outside of the PRC and may even be local to the targeted networks.”

The government did not merely take down a website. The seized domains were hard-coded into QScan and QTRouter and used for core functions such as authentication and command-and-control communication. By taking control of those domains through a court order, the FBI made the malware platforms unable to operate as intended.

This is a useful example of technical disruption rather than simple attribution. Publicly naming a group matters, but it does not stop an operator who already has access to vulnerable devices and a working relay network. Taking away the infrastructure they need to manage that network is more disruptive, at least until they rebuild it.

“Because the seized domains were hard-coded into both the QScan and QTRouter malware and used for essential tasks such as communication and authentication, the court-authorized seizures made QScan and QTRouter inoperable.” DoJ states.

The broader operation looks like an industrial service model. QTFY allegedly used QScan to map targets, identify weaknesses, and compromise devices; it then used QTRouter and other proxy layers to hide where the activity actually came from. Lumen’s Black Lotus Labs described the group as a “digital quartermaster,” meaning it supplied infrastructure and services that could support multiple operations at the same time.

“To support its primary objectives, the quartermaster runs a secondary, completely decoupled target profiling utility called “QScan.” While the core proxy network focuses on managing stateful session paths, the QScan framework operates as the front-end scout.” reads a report published by Lumen. “The operations of this quartermaster demonstrate the high degree of industrialization occurring within China-nexus cyber operations. By shifting away from fragmented, ad hoc setups and toward shared multi-tenant utility networks, state-sponsored actors can execute complex campaigns with a high degree of anonymity and speed, and at a global scale.”

The group reportedly exploited both old and newly disclosed vulnerabilities in widely deployed products, including Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Apache Log4j, Atlassian Confluence, Check Point gateways, CrushFTP, Ivanti appliances, and BeyondTrust Remote Support. This is not a reminder that organisations need magic detection. It is a reminder that old vulnerabilities remain useful because somebody, somewhere, will still leave them unpatched.

The attack chain also included web shells, remote-access trojans, stolen or legitimate credentials, and compromised IoT devices used as nearby relay points. That combination allows an attacker to blend into normal-looking traffic and avoids the obvious infrastructure that defenders have learned to block. A hostile connection that looks like a local consumer router is still hostile; it just has better camouflage.

This seizure follows earlier FBI actions against China-linked botnets. In 2025, the FBI removed PlugX malware from more than 4,000 infected U.S. computers linked to Mustang Panda. In 2024, it disrupted a botnet of hundreds of thousands of IoT devices associated with Flax Typhoon, while in 2023 it acted against a Volt Typhoon botnet used to conceal activity targeting U.S. and foreign critical infrastructure.

“For defenders, the operational lesson is straightforward. Inventory internet-facing assets, patch known vulnerabilities quickly, remove unsupported devices, monitor unusual outbound proxy traffic, and do not assume that an IP address tells you who is behind an attack. The same applies to IoT equipment: a router, camera, network appliance, or smart device left exposed and unmanaged can become part of someone else’s attack platform.

“This disruption announced today is among a series of court-authorized technical operations against indiscriminate hacking activities by the PRC.” concludes DoJ.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, QTRouter)

Microsoft says China-linked Storm-1175 is using a new ransomware called StormEncryptor, replacing Medusa in its latest attacks.

Microsoft says China-linked, financially motivated threat actor Storm-1175 has begun using a new ransomware strain called StormEncryptor. The group previously relied on Medusa ransomware. StormEncryptor is written in C++ and encrypts files and adds the .encrypted extension, then leaves a !!!README_FIRST!!!.txt ransom note in each scanned directory. The change suggests an evolution in the group’s ransomware operations.

“While Microsoft has not confirmed the vulnerability targeted by Storm-1175 in this campaign, the threat actor is likely exploiting the CVE-2026-18577 authentication bypass vulnerability in N-able, which was disclosed on August 2, 2026 and added to the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog on August 3, 2026.” wrote Microsoft on X.

Storm-1175 is known for fast ransomware campaigns that exploit newly disclosed vulnerabilities before organizations can patch them. In recent attacks, the group used tools such as AnyDesk and SimpleHelp for remote access, Advanced IP Scanner to map networks, and Mimikatz to dump LSASS credentials.

Microsoft says the attackers can move from initial access to data theft and ransomware deployment within days, highlighting the need for rapid patching and monitoring.

China-based actor Storm-1175 carries out fast, financially driven ransomware attacks by exploiting newly disclosed vulnerabilities before organizations patch them. The group targets exposed systems and quickly moves from initial access to data theft and ransomware deployment, sometimes within 24 hours. The financially motivated group mainly targets sectors such as healthcare, education, finance, and services across the US, UK, and Australia. The attackers often chain exploits, create new accounts for persistence, move laterally using remote tools, steal credentials, and weaken security defenses. Their speed and focus on unpatched systems make them highly effective.

Microsoft researchers report that the group quickly exploits newly disclosed flaws in web-facing systems to gain access. Since 2023, the group has targeted many platforms, including Microsoft Exchange, Ivanti, ConnectWise, JetBrains, and others. It often weaponizes vulnerabilities within days, or even one day, before organizations apply patches.

“Storm-1175 rapidly weaponizes recently disclosed vulnerabilities to obtain initial access.” reads the report published by Microsoft. “Since 2023, Microsoft Threat Intelligence has observed exploitation of over 16 vulnerabilities, including:

• CVE-2026-1731 (BeyondTrust)”
• CVE-2023-21529 (Microsoft Exchange)
• CVE-2023-27351 and CVE-2023-27350 (Papercut)
• CVE-2023-46805 and CVE-2024-21887 (Ivanti Connect Secure and Policy Secure)
• CVE-2024-1709 and CVE-2024-1708 (ConnectWise ScreenConnect)
• CVE-2024-27198 and CVE-2024-27199 (JetBrains TeamCity)
• CVE-2024-57726, CVE-2024-57727, and CVE-2024-57728 (SimpleHelp)
• CVE‑2025‑31161 (CrushFTP)
• CVE-2025-10035 (GoAnywhere MFT)
• CVE-2025-52691 and CVE-2026-23760 (SmarterMail)

The attackers also chain multiple exploits to achieve deeper access, such as remote code execution, and have targeted both Windows and Linux systems. In some cases, the threat actor used zero-days even before public disclosure, showing advanced capabilities. By focusing on unpatched systems and acting fast, Storm-1175 maximizes impact and maintains a strong advantage over defenders.

Storm-1175 chains multiple exploits to gain deeper access, as seen in attacks on Microsoft Exchange where it moved from initial access to remote code execution. The group also targets Linux systems and has used zero-day flaws before public disclosure, showing advanced skills.

After gaining access, it installs web shells or remote tools, creates admin accounts, and moves laterally using tools like PowerShell, PsExec, RDP, and Cloudflare tunnels. It also abuses legitimate RMM tools and software like PDQ Deployer and Impacket to spread across networks. The attackers can deploy ransomware in as little as one day, highlighting their speed and efficiency.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

China-linked hackers reportedly used eight AI agents to breach a government network, steal data and compromise accounts with minimal human oversight.

Israeli cybersecurity firm Dream documented what looks like the first fully autonomous, end-to-end AI hacking operation against a government target. Over four days at the start of July, according to the Financial Times, suspected Chinese hackers ran a tool built entirely from publicly available AI agents that mapped 21 government systems, hunted for vulnerabilities, and switched tactics on its own whenever it hit a wall.

“Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” reported the Financial Times.

The tool wasn’t a single script running one attack. It deployed up to eight autonomous agents simultaneously, each working a different angle, more like a coordinated hacking team than a piece of malware. By the time researchers found it, the operation had compromised at least 85 government accounts, pulled over 2,500 personnel records, and expanded to hit a nuclear safety agency and at least seven energy companies.

Dream’s chief strategy officer, Amir Becker, spent years running cyber operations for Israel’s Unit 8200 before this, and he’s not easily rattled by new attack tooling. He said flatly he’d never seen anything like this level of autonomy directed at a government before. “This must be the basic assumption of every government around the globe,” Becker said.

He argued that permanent, assumed compromise is now the only realistic starting posture.

Dream won’t officially name the target government, citing company policy, though a person familiar with the matter told the FT it was Taiwan. The clues inside the data point the same direction: internal communications tied to the hacking tool were written in Simplified Chinese, while the data actually stolen from the target came back in Traditional Chinese, the script used almost exclusively by government systems in Taiwan, Hong Kong, and Macau. Taiwan’s Ministry of Digital Affairs declined to confirm anything specific, saying only that incidents involving government agencies follow established response procedures.

What makes this different from an AI model going rogue during a lab test, something Anthropic, OpenAI, and Meta have all separately reported in recent weeks, is that this wasn’t an accident inside a sandbox. Researchers found the toolkit sitting in a 160MB archive, 1,395 files built around two open-source AI agent frameworks, Hermes and OpenClaw, both freely downloadable and designed to let AI models act autonomously on real tasks. Whoever built this deliberately assembled it as a weapon.

Getting the underlying AI model to cooperate took a specific trick rather than brute force. The operators had bypassed the model’s safety guardrails simply by framing the entire hacking campaign as an authorized penetration test, a scenario the model apparently had no reliable way to verify or reject. That’s a strange kind of vulnerability: not a flaw in the code, but a flaw in how convincingly you can lie to a system that’s trying to be helpful.

The part Dream’s researchers found most striking wasn’t the scale, it was the decision-making. The tool kept ranking and reprioritizing possible attack paths as new evidence came in, and when one route hit a dead end, it spun up another agent to search the internet for fresh information and try a different approach, the same iterative process a human red-teamer would run, just without anyone sleeping.

“The most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said.” reported the FT. “When one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would.”

Taiwan’s National Security Bureau already logged an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% year over year; if a meaningful fraction of that volume starts running with this kind of autonomy, the math on defending against it gets a lot uglier very quickly.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI Agents)

China opened a cybersecurity review of Palo Alto Networks, citing national security concerns but giving no details about the reasons behind the probe.

China’s Cyberspace Administration (CAC) announced that it’s launching a cybersecurity review of products Palo Alto Networks sells in the country. The announcement itself runs to a few sentences of formal Chinese, citing national security law and cybersecurity law as the basis for the review, and offers essentially nothing beyond that.

“To ensure the safe and stable operation of critical information infrastructure, prevent cybersecurity risks and vulnerabilities, and safeguard national security, in accordance with the National Security Law of the People’s Republic of China and the Cybersecurity Law of the People’s Republic of China, the Cybersecurity Review Office, following the Cybersecurity Review Measures, has conducted a cybersecurity review of Palo Alto Networks’ products sold in China.” the regulator says.

That’s the entire public justification. No specific vulnerability named, no incident referenced, no timeline for when findings might land. Palo Alto Networks told The Register it maintains high standards across its global operations and that, for now, there’s no impact on its ability to serve customers or deliver products in the region.

The situation resembles China’s 2023 security review of Micron, which was announced without warning. Weeks later, Beijing deemed Micron’s products a security risk for critical infrastructure, effectively restricting sales, but provided little explanation. Micron eventually withdrew its data center and server products from China, losing billions in annual revenue while local chipmakers gained new opportunities.

Micron’s story offers one genuinely reassuring data point for Palo Alto, if it’s any comfort: getting banned from a major market didn’t permanently damage the company. The AI boom drove memory prices high enough afterward that the China restriction barely shows up in Micron’s financials today. Getting frozen out of a market stings a lot less when the rest of the world is buying everything you can produce anyway.

China has already been pushing companies away from foreign cybersecurity products: in January, authorities reportedly told Chinese firms to stop using security software from a list of U.S. and Israeli vendors that included Palo Alto Networks, Fortinet, Check Point, CrowdStrike and others, encouraging the replacement of those products with domestic alternatives. Chinese vendors such as Huawei and H3C have increasingly positioned their own firewalls and security platforms as alternatives to foreign products, while other domestic companies are expanding across the cybersecurity market. H3C, for example, openly promotes its security products as replacements for overseas technologies.

That makes the Palo Alto review more than a simple technical investigation. It fits a broader strategy in which cybersecurity and national security are increasingly intertwined with China’s push for technological self-reliance.

For Palo Alto, the immediate financial impact is difficult to measure because the company does not separately report China revenue, but restrictions could still create an opening for domestic competitors while adding another layer of uncertainty for Western technology companies operating in the country.

There is also a wider geopolitical dimension. Beijing has repeatedly framed foreign technology as a potential national-security risk, while Washington and its allies have taken similar measures against Chinese and Russian vendors, including Huawei, ZTE and Kaspersky. The United States, for example, banned Kaspersky’s cybersecurity and antivirus products over national-security concerns, arguing that the software created risks because of its ties to Russia. The Palo Alto case therefore sits within a much larger cycle of reciprocal distrust, in which cybersecurity products are increasingly treated not only as commercial technologies but also as potential strategic assets.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)

Unit 42 uncovered an AI-driven Chinese hacking campaign where DeepSeek autonomously scanned targets, selected exploits, and launched attacks.

Researchers at Palo Alto’s Unit 42 got a front-row seat to something they’d only theorized about before: an AI system running an actual hacking campaign with almost no human steering it. The researchers spotted a Chinese-speaking actor, going by the handles knaithe and KnYuan, who wired DeepSeek into an open-source framework called Hermes Agent and let it hunt for vulnerable targets, find exploit code, and launch attacks on its own.

The researchers only saw any of this because the attacker made one careless mistake.

That mistake was starting a file server in the operation’s home directory instead of an isolated staging folder. It exposed everything: API keys, exploit scripts, target lists, bash history, and full session logs of the AI actually doing the work.

Unit 42 essentially got to watch the attacker’s screen after the fact.

DeepSeek wasn’t the only AI in play. The actor also tested Qwen, GLM, Kimi, and MiniMax, and even poked at two Western tools, Claude Code and Codex, though only in a limited, exploratory way. Claude Code got ten total interactions across three sessions, mostly connectivity checks; Codex’s actual use couldn’t be confirmed because the attacker had disabled its conversation logging.

“In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax). We also identified limited usage and testing of Western platforms. This includes Claude Code for connectivity testing and proxy validation.” reads the report published by Unit 42. “There were also signs of usage of Codex on exploit development directories. This limited usage is consistent with evaluating the AI-market to identify their preferred tool set.”

The tool configuration says a lot about intent. Both Western tools got routed through a third-party proxy to hide the connection, with attribution headers stripped and non-essential traffic disabled. DeepSeek and Qwen, by contrast, connected straight to their native APIs with no such precautions, which tells you which tool the attacker actually trusted for the job.

“DeepSeek, operating through the Hermes Agent framework, served as the actor’s primary offensive AI tool. Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making.” continues the report.

“The actor had customized Hermes Agent with three red-teaming skills:

• fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor’s fofoapi.py script for internet asset enumeration”
• godmode: LLM jailbreaking, framework-bundled
• web-terminal-exploitation: unauthenticated WebSocket exploitation, custom-created”

Watching DeepSeek work through an actual attack chain is the most striking part of the report. It found a Langflow vulnerability (CVE-2026-33017), downloaded a public proof-of-concept, scanned for 84 live instances, and hit a wall: every target needed either a public flow ID or a login setting the attacker didn’t have access to. Rather than giving up, DeepSeek talked itself through the dead end and moved on, reasoning in real time that the deployment base was too small to bother with and it should look for something bigger.

That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had. FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China. DeepSeek chained two separate vulnerabilities together, worked out exactly which version range was exploitable, then ran headfirst into the same kind of wall as before, every accessible form endpoint it found required authentication it didn’t have.

The AI never fully broke in anywhere during these autonomous runs. But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes. “the system executed hundreds of hours of manual targeting analysis in mere minutes”, and that’s the number that should worry defenders more than any single failed exploit.

“While most of the systems were unreachable or non-responsive, DeepSeek found three with the vulnerable versions and attempted to exploit them automatically. This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.” continues the report. “Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987). “

While the AI chased those two failures, the same actor was busy elsewhere doing old-fashioned manual hacking that actually worked. They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. One target, a government body in Malaysia, got hit repeatedly over multiple days with increasingly careful technique and proxy anonymization layered in on later attempts, a level of patience the fully-automated runs never showed.

Unit 42 traces the actor back to Zhuhai, China, partly through a side project on GitHub: an automated tool that scrapes seventeen sources for newly disclosed remote-code-execution bugs, uses DeepSeek to sort which ones are actually exploitable, and pushes alerts out over Telegram. That’s a hacker who’s already comfortable outsourcing judgment calls to a language model well before this campaign started.

Nothing here fully succeeded, and that’s exactly the point researchers are making. The only thing standing between working exploits and failed ones was target-side configuration that happened to be tighter than average, not any weakness in the attacker’s approach. Build your systems with the defaults this campaign got blocked by, because the AI running the offense clearly isn’t going to be the bottleneck for much longer.

“Our findings document a threat actor developing AI-augmented offensive capabilities that enabled them to dramatically increase the speed and scale of their campaigns.” concludes the report. “This research validates an emerging threat posed by AI-enabled attackers as they hone their autonomous attack processes to discover, assess, pivot and retarget without human intervention.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, AI)

SilverFox targeted a Japanese manufacturer with new DLL sideloading techniques, kernel drivers, and resilient ValleyRAT persistence mechanisms.

Cato CTRL documented a new SilverFox campaign targeting a Japanese industrial manufacturer. The attack chain adds two previously undocumented DLL-sideloading hosts, two kernel drivers not previously associated with SilverFox, and a dual-layer recovery architecture that keeps ValleyRAT running even if defenders terminate individual components.

The attack chain starts with an invoice-themed phishing email. The last stage was remote access via ValleyRAT. Everything in between is the interesting part.

“The attack begins with an invoice-themed phishing lure and uses attacker-controlled content hosted through legitimate QQ and Tencent Cloud services. The attackers then abuse ConvertToPDF.exe and PDFDirect.exe to sideload a malicious PDFCORE8.dll.” reads the report published by Cato. “Based on the public research we reviewed, neither application had previously been documented as a DLL-sideloading host.”

Both applications are legitimate products from Zeon Corporation, digitally signed and unmodified. The attack works because Windows resolves DLL dependencies from the local working directory first, so placing a malicious PDFCORE8.dll in the same folder as the trusted executable is enough.

In some samples, the executable was also renamed MicrosoftEdgeUpdate.exe to reduce suspicion further, which at least shows a sense of humor about impersonation targets.

Once loaded, PDFCORE8.dll operates as a self-contained execution framework with all its most dangerous components stored inside as encrypted resources.

“The malicious PDFCORE8.dll embeds BootRepair.sys, EnPortv.sys, and wsftprm.sys and manages them through shared resource-decryption, driver-deployment, service-creation, and device-communication routines.” continues the report. “One of the most significant findings in this campaign is SilverFox’s modular BYOVD framework. Rather than depending on a single signed but vulnerable driver, the malware supports three options: BootRepair.sys, EnPortv.sys, and wsftprm.sys.“

Across variants, the malware mainly changes the driver image, device name, and IOCTL value while reusing the same core framework.

The practical implication of this modular design is that blocking one driver doesn’t stop the attack, the framework simply tries another. BootRepair.sys and EnPortv.sys are both new associations for SilverFox; wsftprm.sys appeared in prior reporting on the group.

All three drivers ultimately serve the same purpose: getting a process identifier into kernel space and calling ZwTerminateProcess() on security products that user-mode processes can’t touch. The user-mode component enumerates running processes, matches them against a hardcoded list of endpoint security tools, and passes the PIDs to whichever driver is loaded. The driver handles the actual kill from kernel mode. The malware also unhooks NTDLL by replacing its in-memory .text section with a clean copy from disk, removing inline monitoring hooks before calling native Windows APIs.

After terminating security processes and cleaning up API hooks, the malware contacts its C2 at 43.128.26[.]132, downloads shellcode, injects it into a suspended svchost.exe process via thread-context hijacking, and stores both the shellcode and its configuration in the registry, under HKCU\Console\0 and HKLM\SOFTWARE\IpDates_sun respectively.

“Before executing the registry-resident shellcode, the malware searches it for the marker: FaCai2024 The marker does not represent executable instructions. Instead, it identifies a reserved region inside the payload where the malware inserts its runtime configuration.” continues the report. “The framework retrieves the configuration from: HKLM\SOFTWARE\IpDates_sun It then replaces the FaCai2024 placeholder with the recovered C2 information, producing a fully configured payload immediately before execution. This separation gives the attacker operational flexibility. The same stored payload can be reused with updated server addresses or ports without changing the payload body itself.”

“Fa Cai” means “become prosperous” in Mandarin. Tencent Security previously documented the same marker and registry location in earlier FaCai phishing group activity.

The recovery architecture is what makes this campaign notably harder to disrupt than typical malware deployments. An internal monitoring routine checks every cycle whether the injected svchost.exe process is still active, and recreates the payload if it isn’t. An external watchdog, a batch script embedded in the DLL’s resources and executed via cmd.exe, checks every 30 seconds whether the loader itself is still running, and relaunches it if not. Defenders who terminate only the injected payload leave the loader running to recreate it.

Defenders who terminate only the loader leave the watchdog running to restart it. Both components need to go simultaneously, and then the scheduled task that relaunches the loader on logon needs to go too.

Detection should focus on behavior sequences rather than individual indicators. ConvertToPDF.exe or PDFDirect.exe executing from %TEMP%, kernel-driver services for any of the three embedded drivers appearing, binary data written to HKCU\Console\0, and tasklist.exe or find.exe running repeatedly from cmd.exe are each individually explainable — together they describe this specific attack chain. Cato’s NGAM blocked the malicious PDFCORE8.dll before the driver deployment stage was reached in the observed incident, which cut the chain at its most central point since the DLL contains every subsequent capability the attack depends on.

“This campaign shows how SilverFox is expanding its defense-evasion and remote-access toolkit. The most significant additions are the previously undocumented SilverFox use of BootRepair.sys and EnPortv.sys, along with the abuse of ConvertToPDF.exe and PDFDirect.exe as DLL-sideloading hosts.” concluders the report. “The malicious PDFCORE8.dll brings these capabilities together in one modular stage that combines vulnerable-driver deployment, security-process termination, NTDLL unhooking, thread-context hijacking, registry-based payload storage, and dual recovery mechanisms. This design improves resilience by allowing the malware to restore execution if either the payload or loader is interrupted.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, SilverFox APT)

Researchers found China’s Daxin rootkit and a new Stupig backdoor on a Taiwan firm’s network, suggesting a stealthy intrusion dating back to 2013.

Symantec’s Threat Hunter Team found Daxin running on a compromised host at a Taiwan-based subsidiary of a multinational high-tech manufacturer in 2026. Daxin is a Windows kernel-mode rootkit that Symantec first documented in March 2022, with evidence of use in targeted attacks against governments and critical infrastructure dating back to 2013.

“Backdoor.Daxin, the China-linked kernel-mode rootkit that Symantec first uncovered and exposed in 2022, is still operational.” reads the report published by Symantec. “It was found running on a compromised host in Taiwan in 2026, more than four years after it was first uncovered.”

The same machine also carried a previously unreported backdoor, which the researchers are tracking as Stupig. Both artifacts carry compilation timestamps from early 2013. Telemetry from the machine only started appearing on May 12, 2026. The implication is that this intrusion may have gone undetected for thirteen years.

Neither of these is a new tool in the sense that they were recently written. What’s new is that they’re still in use, still operational, and apparently were never removed from at least this one network. Thirteen years is a long time to be inside someone’s infrastructure without anyone noticing.

Daxin is implemented as a Windows kernel driver, a rare choice for malware authors. The malware implements advanced communication capabilities that allow the attackers to communicate with infected computers on highly secured networks, where direct internet connectivity is not available.

The malware can hide its traffic in normal network traffic on the target’s network and abuse legitimate services already running on the infected computers.

Daxin doesn’t reach out to attacker-controlled servers the way most malware does. Instead, it monitors incoming TCP traffic on the host for specific patterns and hijacks existing legitimate connections to run its encrypted communications, blending in with traffic that’s already there.

“Rather than establishing its own outbound connections, the driver monitors incoming TCP traffic for specific patterns and hijacks existing legitimate connections to carry encrypted command-and-control (C&C) traffic.” states Symantec. “This made Daxin exceptionally difficult to identify with conventional network monitoring. “

That multi-hop capability is significant: it means the operator can reach machines that have no direct internet connection by routing commands through a chain of compromised machines that do. Standard network monitoring looking for outbound connections to suspicious destinations would find nothing.

Stupig disguises itself as kbdus1.dll, mimicking the legitimate kbdus.dll file that Windows uses for the U.S. English keyboard layout. It registers itself as a keyboard-layout provider, which causes win32k.sys to load it into winlogon.exe at system startup.

“Backdoor.Stupig is a DLL backdoor that achieves persistence by registering as a keyboard-layout provider, causing win32k.sys to load it into winlogon.exe at system startup.” the Symantec team explains. “The DLL returns a valid KBDTABLES pointer so the keyboard layout functions normally, giving nothing away to any process or administrator inspecting the loaded module.”

The keyboard works perfectly. Nothing looks wrong. The backdoor is just sitting there, loaded into the Windows login process.

Once it’s running inside winlogon.exe, Stupig watches the Windows login screen for usernames that begin with the string “stupig.” Whatever follows that prefix is treated as a command and executed with SYSTEM privileges, which is the highest level of access on a Windows machine. If someone types the prefix with nothing after it, the backdoor opens a command prompt with SYSTEM privileges directly on the login screen, before any user has authenticated.

“Stupig uses a technique not documented in any known malware family. A Trojanized keyboard-layout DLL loaded by winlogon.exe lets an attacker run commands as System directly from the Windows logon screen, before anyone signs in and without raising a logon audit event.” continues the report.

No login event is logged. No audit trail. A defender monitoring authentication logs would see nothing.

The experts still have to discover how the host was originally compromised. The most likely entry point, based on what was found, is an outdated version of the Digiwin single sign-on portal that was running end-of-life Java Development Kit versions 1.5 and 1.6, software from 2009 to 2011. That’s a significant attack surface left exposed on a network belonging to a subsidiary of a multinational manufacturer.

Symantec hasn’t found code-level overlap between Daxin and Stupig, so there’s no technical proof they came from the same development team. What connects them is deployment on the same host, complementary functions, similar development practices, and identical 2013 compile timestamps. One tool handles deep network persistence and covert communications. The other provides pre-authentication SYSTEM access through a mechanism most security teams aren’t monitoring.

“If linked to the same actor, the Stupig backdoor adds a further capability.” concludes the report. “By hiding inside the Windows logon process and registering as a keyboard-layout provider, Stupig gives operators SYSTEM-level command execution and credential theft before a user signs in, an access method most defenders are not aware of nor watching for. Whether the same operators deployed both tools cannot be confirmed, but their functions are complementary.”

The practical upshot for defenders is to add keyboard-layout DLL loading to the list of things worth monitoring, particularly anything being loaded into winlogon.exe at startup that wasn’t there before. The Windows login process is not a place most security teams look for malicious activity, which is precisely why this works.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Daxin rootkit)

Chinese actors used Claude Code and DeepSeek to automate attacks that breached government systems and targeted financial firms.

Hunt.io researchers stumbled onto an active intrusion campaign in June 2026 while pivoting on known TencShell command-and-control infrastructure. A single HTTP header fingerprint on port 1111 led them to 13 Hong Kong-based servers and, on one of them, an open directory containing 2,431 files and 80 subdirectories: victim source code, custom exploit scripts, cloned login pages, and operator logs with notes written in Simplified Chinese. Someone left the door open. Researchers walked right in.

What made this find unusual wasn’t just the scope of the targeting. It was the tooling.

“What caught our attention was the tooling behind it. Claude Code and DeepSeek-v4-pro ran as working parts of the intrusion, not tools off to the side. They handled reasoning for bypass techniques, reworked exploits after failed attempts, and built the phishing pages used to harvest credentials.” reads the report published by Hunt.io. “That puts this campaign alongside Anthropic’s November 2025 disclosure of a China-linked operation that used Claude Code to automate large-scale intrusions.”

This puts the campaign alongside Anthropic’s own November 2025 disclosure of a China-linked operation that used Claude Code to automate large-scale intrusions.

The campaign resembles another China-linked operation that Anthropic disclosed in November 2025, where attackers also used Claude Code to automate large-scale intrusions.

The recovered logs show that the attackers split the work between two AI models. Claude Code 2.1.165 handled execution by running Bash commands, managing long-running sessions, carrying out tasks in parallel, and creating phishing infrastructure. DeepSeek-v4-pro handled the planning by generating scripts, choosing attack techniques, and finding new ways to bypass defenses when earlier attempts failed.

“DeepSeek-v4-pro operates as the underlying reasoning model, handling attack logic, script generation, and decision-making.” continues the report. “In short, offensive logic is routed through a Chinese domestic LLM while leveraging Anthropic’s agentic execution infrastructure.”

A recovered CLAUDE.md file also contained instructions telling Claude Code to automatically create, test, and improve cloned phishing pages for multiple targets.

Session IDs in the logs confirmed the same infrastructure was used across different country-specific campaigns, with Taiwan operations saved to dedicated working directories. Timestamps on the files span June 8 through 12, 2026, and the three servers sharing SSH keys were actively maintained as recently as June 18-19, when all three reissued their ARL certificates together.

In Thailand, attackers used SQLMap to exploit a government administrative system through SQL injection, gained admin panel access, and deployed a web shell disguised as a GIF file for persistent command execution. The exfiltrated database held the names, national ID numbers, and job titles of government employees. The directory contained 980 files referencing this system alone, suggesting a lengthy and focused operation. Test entries the attackers created during the intrusion confirmed they had hands-on, interactive access to the data, not just automated extraction.

In Afghanistan, a government web application handling citizen complaint submissions was compromised. The attackers extracted source code, database credentials, encryption keys, and mail infrastructure code from a Laravel 5.8.38 installation, then used those credentials to build a custom Python exploit targeting Laravel’s deserialization mechanisms. Six distinct copied versions of the complaint submission form appeared in the directory. For a state actor, access to a live channel where citizens report grievances against government and institutions is a particular kind of intelligence prize.

In Taiwan, eight organizations in supply chain and defense-adjacent sectors were mapped and fingerprinted, with two successfully exploited. A chemical manufacturer was hit through SQL injection. A telecom and edge device manufacturer was compromised after attackers found hardcoded Supabase keys and Azure Logic App tokens in publicly accessible JavaScript files, giving them direct access to cloud infrastructure accounts. The reconnaissance script targeting these organizations ran DNS brute-forcing, certificate transparency queries, and HTTP service fingerprinting with an emphasis on VPN gateways, GitLab instances, and Jira environments.

The United States appeared at earlier stages of the operation rather than as a confirmed breach. NASA hosts launchpad.nasa[.]gov and ngis.nasa[.]gov were logged in network scanning output but not pursued further. Cloned pages impersonating the D.C. Council and Delaware County, Pennsylvania were recovered at varying levels of completion: the D.C. Council WordPress admin login page was fully built while the homepage was still missing images.

Hunt.io assessed the targeting of mid-tier government administrative bodies as consistent with documented Chinese intelligence collection priorities around procurement, vendor relationships, and policy visibility. The county contact form clone, specifically built to capture citizen submissions, fits that same pattern.

A parallel campaign hit financial services firms across Europe, Australia, and Asia. A CORS exploit page on one of the attacker-controlled servers successfully extracted WordPress administrator credentials from a large payment processing platform, with LinkedIn cross-referencing confirming the extracted account names matched real employees.

“In addition to the government-sector activity, the operators ran a parallel campaign against financial services firms across multiple regions. The clearest example being an attacker-developed CORS exploit page on 112.213.124[.]159 that successfully extracted WordPress administrator account data from a large payment processing platform.” states the report. “A cross-reference on the exposed accounts against public LinkedIn profiles, confirmed individuals with the same name as employees of the company.”

The 13 servers are all in Hong Kong, spread across four hosting providers: VMISS Inc., MEGA-II IDC, CTG Server Limited, and Antbox Networks Limited. Three share SSH host key fingerprints and ran identical ARL reconnaissance software serving the same default TLS certificate, with fields pointing to Shanghai. Two servers in the cluster also presented certificates self-identifying as “Gshell C2,” a previously undocumented C2 framework. Because those two servers overlap with the TencShell cluster, Hunt.io assesses with moderate confidence that Gshell is a second C2 framework operated in parallel by the same actors.

The malware recovered from the delivery ports was a previously unreported Linux/ARM 32-bit binary that communicates back to the same infrastructure hub over WebSocket. It’s capable of extracting Tencent QQ messaging credentials including SDK identifiers and cryptographic keys, enterprise messaging platform tokens, and cloud service access keys. A separate Linux/x86 variant uses the Go obfuscation tool garble to strip function names, but both variants share an identical 80-byte encryption key, pointing to a shared codebase across architectures.

“The campaign reflects an intermediate-to-advanced capability set: custom exploit development aimed at specific framework versions, multi-platform malware variants, and integration of LLMs for real-time attack assistance.” concludes the report. “Observable indicators: Simplified Chinese in code and documentation, Hong Kong infrastructure clustering, and multi-continent targeting, are consistent with China-based threat actor activity.”

Hunt.io notified the affected organizations and national CERTs on July 6, 2026, and held publication for a seven-day disclosure window. The full indicator set, including file hashes and network infrastructure, is in the original report.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, LLM)

China-linked FishMonger used two SprySOCKS Windows variants that leveraged kernel drivers and the Print Spooler to target governments in four countries.

ESET researchers have found two previously undocumented Windows versions of SprySOCKS, a backdoor that the security community had until now treated as Linux-only. Trend Micro first documented the Linux variant in September 2023 and attributed it to Earth Lusca, a China-linked actor also tracked as Aquatic Panda, Charcoal Typhoon, and RedHotel, which has been active since at least 2021 and operated by a Chinese contractor named i-Soon. ESET researchers track the same cluster as FishMonger and place it under the broader Winnti umbrella.

“ESET researchers have discovered two as-yet undocumented Windows variants of SprySOCKS, a previously Linux-only backdoor reportedly used by FishMonger” reads the report published by ESET. “The Windows variants discovered are internally marked as WIN_DRV and WIN_PLUS. Both come with a hardcoded C&C configuration and support communication over TCP, UDP, and WebSocket protocols.”

The two variants are part of SprySOCKS version 1.8 and share the core architecture of the Linux original variant: the same command-and-control protocol, the same encryption, the same overall command handling logic. However, these samples use a different delivery mechanism and are more stealthy.

WIN_DRV is the more technically interesting of the two. It uses a kernel driver named RawWNPF, stored on disk as KW1B5206BDC1743FP.dat, to hide the malware’s network connections, running processes, files, and registry keys from any tool operating at the user level. A second encrypted kernel driver called DriverLoader handles loading RawWNPF. The attack chain starts with an undetermined initial access method that drops a batch script, which creates a scheduled task, which triggers a DLL side-loading sequence that installs the backdoor and its driver components. It’s a lot of steps, but each one is there for a reason.

WIN_DRV also implements TCP traffic diversion. The backdoor receives commands through a random TCP port on the victim’s device, with nothing in the network traffic revealing which port is actually listening. That makes detection through network monitoring considerably harder.

“The WIN_DRV variant creates a stealthy passive TCP backdoor, relying on a kernel driver to redirect traffic to the backdoor’s hidden TCP port whenever specially crafted data is detected inside a received TCP packet.” continues the report.

WIN_PLUS takes a different approach to staying hidden. It uses the Windows Print Spooler service, spoolsv.exe, as its starting point. A first-stage loader runs as a print processor, then injects a SprySOCKS loader into a newly created svchost.exe process to launch the backdoor. Both processes are ones that appear in normal Windows environments constantly, which makes the activity blend into background noise. WIN_PLUS was first detected in July 2024 on a device in Pakistan.

Both variants support the same command set: collecting system information, launching an interactive shell, enumerating running processes, listing services, initializing a SOCKS proxy, uploading and downloading files, and executing files already on the system. Evidence suggests the artifacts were deployed between 2023 and 2024 against government organizations in Honduras, Taiwan, Thailand, and Pakistan. FishMonger’s previous targets include organizations in Taiwan, Hungary, Turkey, Thailand, France, and the US, documented in ESET’s March 2025 report on Operation FishMedley.

There’s also a detail at the edge of the report that deserves attention. ESET found limited indications suggesting the possible use of a UEFI bootkit, potentially exploiting CVE-2023-24932, the Windows Boot Manager vulnerability associated with BlackLotus. Microsoft patched it in May 2023. Whether this is confirmed or circumstantial remains unclear, but a UEFI-level component would mean persistence that survives OS reinstalls.

SprySOCKS is derived from a Windows remote access tool called Trochilus, which also underpins RedLeaves, another backdoor with significant source code overlap. A third group, Webworm, shares tradecraft with both FishMonger and SixLittleMonkeys, and also uses Trochilus. When multiple Chinese state-linked groups draw from the same codebase, attribution gets complicated fast.

“The discovery of a Windows variant of SprySOCKS, previously known as Linux-only backdoor, represents a meaningful expansion of FishMonger’s cross-platform capabilities.” concludes the report. “Our analysis shows that the Windows port retains most of the core architecture of its Linux predecessor – including the C&C protocol, encryption used, and overall command handling logic – while substituting Windows-native mechanisms where required and improving the stealthiness of the backdoor by bringing the kernel drivers to the game. “

For defenders, the practical consequence is straightforward: detection rules and threat intelligence built around SprySOCKS as a Linux-only threat now need to cover Windows endpoints as well, including kernel-level driver activity and Print Spooler abuse as potential indicators.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, FishMonger)