Geek-Guy.com

Category: Asia Pacific

As White House moves to send AI chips to China, Trump’s DOJ prosecutes chip smugglers

As the Trump administration considers loosening restrictions on the sale of high-performance computer chips that power modern artificial intelligence systems to China, his Department of Justice continues to prosecute businesses and individuals who sell or divert these same technologies to companies based in China.  On Monday, federal prosecutors announced that it had secured a guilty…

Chinese Hackers Have Started Exploiting the Newly Disclosed React2Shell Vulnerability

Two hacking groups with ties to China have been observed weaponizing the newly disclosed security flaw in React Server Components (RSC) within hours of it becoming public knowledge. The vulnerability in question is CVE-2025-55182 (CVSS score: 10.0), aka React2Shell, which allows unauthenticated remote code execution. It has been addressed in React versions 19.0.1, 19.1.2, and…

BRICKSTORM backdoor exposed: CISA warns of advanced China-backed intrusions

CISA details BRICKSTORM, a China-linked backdoor used by China-linked APTs to secure long-term persistence on compromised systems. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed technical details on BRICKSTORM, a backdoor used by China state-sponsored threat actors to gain and maintain long-term persistence on compromised systems, highlighting ongoing PRC cyber-espionage activity. “The Cybersecurity…

CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday released details of a backdoor named BRICKSTORM that has been put to use by state-sponsored threat actors from the People’s Republic of China (PRC) to maintain long-term persistence on compromised systems. “BRICKSTORM is a sophisticated backdoor for VMware vSphere and Windows environments,” the agency said.…

SMS Phishers Pivot to Points, Taxes, Fake Retailers

China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say…

Officials warn about expansive, ongoing China espionage threat riding on Brickstorm malware

Cybersecurity authorities and threat analysts unveiled alarming details Thursday about a suspected China state-sponsored espionage and data theft campaign that Google previously warned about in September. The outlook based on their limited visibility into China’s sustained ability to burrow into critical infrastructure and government agency networks undetected, dating back to at least 2022, is grim.…

Sean Plankey nomination to lead CISA appears to be over after Thursday vote

Sean Plankey’s nomination to lead the Cybersecurity and Infrastructure Security Agency looks to be over following his exclusion from a Senate vote Thursday to move forward on a panel of Trump administration picks. Multiple senators placed holds or threatened holds on his nomination, some related to cybersecurity. But the hold from Sen. Rick Scott, R-Fla., appeared…

Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China

The threat actor known as Silver Fox has been spotted orchestrating a false flag operation to mimic a Russian threat group in attacks targeting organizations in China. The search engine optimization (SEO) poisoning campaign leverages Microsoft Teams lures to trick unsuspecting users into downloading a malicious setup file that leads to the deployment of ValleyRAT…

Five-page draft Trump administration cyber strategy targeted for January release

The Trump administration is aiming to release its six-part national cybersecurity strategy in January, according to multiple sources familiar with the document. The document, which is a mere five pages long, will possibly be followed by an executive order to implement the new strategy. The administration has been soliciting feedback in recent days, which one…

Cloudflare mitigates record 29.7 Tbps DDoS attack by the AISURU botnet

Cloudflare blocked a record 29.7 Tbps DDoS attack from the AISURU botnet. The 69-second attack set a new high, though the target remains undisclosed. Cloudflare stopped a record 29.7 Tbps DDoS attack from the AISURU botnet, a 69-second barrage that set a new volume record. The cybersecurity firm did not disclose the name of the…

Wie Unternehmen sich gegen neue KI-Gefahren wappnen

KI ist nicht nur ein Tool für Hacker, sondern kann auch selbst zur Gefahr werden. inray27 – Shutterstock.com In der Welt der Cybersicherheit gibt es ein grundlegendes Prinzip, das auf den ersten Blick widersprüchlich klingen mag: „Wir hacken, bevor Cyberkriminelle die Gelegenheit dazu bekommen.“ Um dies umzusetzen und Produktionsstraßen oder Maschinen zu schützen, setzen Unternehmen…

The Congressional remedy for Salt Typhoon? More information sharing with industry

When news broke approximately a year ago that Chinese hackers had systemically penetrated at least nine major U.S. communications networks, the level of alarm from policymakers was clear.   At a hearing held Tuesday by the Senate Committee on Commerce, experts offered differing assessments of the threat. While intelligence officials have characterized the Salt Typhoon operation’s…

The AI Fix #78: The big AI bubble, and robot Grandma in the cloud

In episode 78 of The AI Fix, alien robot spiders invade Antarctica (or Facebook says they do), Mark prepares humanity for AI-powered fighter jets with loyalty issues, and Graham tries to work out why his AI-generated country music career hasn’t yet paid for even a Tesco Meal Deal. Anthropic claims it has caught the first…

Exploring Singapore with Ease: How to Set Up Your Tourist eSIM in Minutes

In this post, you will learn how to set up your tourist eSIM in minutes. Staying connected while traveling internationally has become as essential as booking your flights and accommodation. Whether you’re navigating unfamiliar streets using maps, sharing your adventures on social media, or keeping in touch with loved ones back home, reliable internet access…

Is Your Android TV Streaming Box Part of a Botnet?

On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive…

Chinese DeepSeek-R1 AI Generates Insecure Code When Prompts Mention Tibet or Uyghurs

New research from CrowdStrike has revealed that DeepSeek’s artificial intelligence (AI) reasoning model DeepSeek-R1 produces more security vulnerabilities in response to prompts that contain topics deemed politically sensitive by China. “We found that when DeepSeek-R1 receives prompts containing topics the Chinese Communist Party (CCP) likely considers politically sensitive, the likelihood of it

BadAudio malware: how APT24 scaled its cyberespionage through supply chain attacks

APT24 used supply chain attacks and varied techniques to deploy the BadAudio malware in a long-running cyberespionage campaign. China-linked group APT24 used supply-chain attacks and multiple techniques over three years to deploy the BadAudio downloader and additional malware payloads, Google Threat Intelligence Group (GTIG) warns. According to the researchers, the group shifted from broad web…

China-Linked APT31 Launches Stealthy Cyberattacks on Russian IT Using Cloud Services

The China-linked advanced persistent threat (APT) group known as APT31 has been attributed to cyber attacks targeting the Russian information technology (IT) sector between 2024 and 2025 while staying undetected for extended periods of time. “In the period from 2024 to 2025, the Russian IT sector, especially companies working as contractors and integrators of solutions…

FCC reversal removes federal cyber safeguards targeting telecom weaknesses post-Salt Typhoon attacks

The US federal government is rolling back mandates intended to protect critical infrastructure following the widespread Salt Typhoon attacks. The Federal Communication Commission (FCC) has reversed a January 2025 Declaratory Ruling requiring US telecom providers to adopt and certify stricter cybersecurity measures. The ruling took effect under the Communications Assistance for Law Enforcement Act (CALEA),…

APT24 Deploys BADAUDIO in Years-Long Espionage Hitting Taiwan and 1,000+ Domains

A China-nexus threat actor known as APT24 has been observed using a previously undocumented malware dubbed BADAUDIO to establish persistent remote access to compromised networks as part of a nearly three-year campaign. “While earlier operations relied on broad strategic web compromises to compromise legitimate websites, APT24 has recently pivoted to using more sophisticated vectors targeting

SEC drops case against SolarWinds tied to monumental breach

The Securities and Exchange Commission on Thursday dropped its case against SolarWinds and its chief information security officer over its handling of an alleged Russian cyberespionage campaign uncovered in 2020, an incident that penetrated at least nine federal agencies and hundreds of companies. The SEC’s decision brings to a halt one of the more divisive…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

Top Senate Intel Dem warns of ‘catastrophic’ cyber consequences of Trump admin national security firings, politicization

Politicization of intelligence in the Trump administration, as well as the “hollowing out” of government expertise, is leaving the United States dangerously vulnerable to cyberattacks and other threats, the top Democrat on the Senate Intelligence Committee said in a floor speech Thursday. Mark Warner of Virginia chastised the president over what he called the politically-motivated…

China‑linked PlushDaemon hijacks DNS via ‘EdgeStepper’ to weaponize software updates

PlushDaemon, a China-linked APT group, has been deploying a previously undocumented network implant dubbed EdgeStepper to hijack DNS traffic on compromised network devices. According to findings disclosed by ESET researchers, the hijacked traffic is then redirected to attacker-controlled infrastructure, enabling the delivery of malicious payloads. “First, PlushDaemon compromises a network device (for example, a router)…

Trump calls for federal AI standard, warns China will ‘easily catch’ US

President Donald Trump on Tuesday called on Congress to establish a single federal standard for AI regulation, as House Republicans explore attaching preemption language to the National Defense Authorization Act that could override state AI laws nationwide. In two posts on Truth Social, Trump urged lawmakers to act quickly. “Investment in AI is helping to…

唉! New Kaiji Malware Attacks IoT devices using SSH Brute Force

The Kaiji malware was designed by a developer based in China to launch DDoS attacks according to researchers. The Internet of Things (IoT) has revolutionized the way we interact with the digital world. From smart refrigerators to connected thermostats, these devices offer convenience and automation. However, with this growing network of interconnected devices comes a…

Behind the firewall: The hidden struggles of cyber professionals with a disability

Problem-solving is what cyber professionals do best, but one problem the industry has yet to solve is inclusion. Despite progress in diversity, research shows many professionals with disabilities or neurodivergent still face bias and challenges in the workplace. The UK’s Decrypting Diversity 2021 report, a joint study by the National Cyber Security Centre and KPMG…

You Will Never Send Money Digitally Without a Private Company — If the GOP Gets Its Way

Americans who want to transfer money online have options. They can go with services like Venmo and PayPal, make transfers from their personal bank, or do a transaction with stablecoins issued by cryptocurrency companies. All those options have something in common that may not always occur to consumers: The transfers are offered by exclusively by…

Gipfel in Berlin – Europa strebt digitale Souveränität an

Am 18. November 2025 findet der Summit on European Digital Sovereignty in Berlin statt. mr_tigga – shutterstock.com Bundeskanzler Friedrich Merz (CDU) und Frankreichs Präsident, Emmanuel Macron, haben sich angekündigt zum Treffen der Digitalminister und IT-Fachleute in Berlin. Rund 900 Teilnehmer werden beim Europäischen Gipfel zur Digitalen Souveränität am Dienstag erwartet. Was lange Zeit ein Nischenthema für…

Anthropic: China-backed hackers launch first large-scale autonomous AI cyberattack

China-linked actors used Anthropic’s AI to automate and run cyberattacks in a sophisticated 2025 espionage campaign using advanced agentic tools. China-linked threat actors used Anthropic’s AI to automate and execute cyberattacks in a highly sophisticated espionage campaign in September 2025. The cyber spies leveraged advanced “agentic” capabilities rather than using AI only for guidance. Attackers…

China’s ‘autonomous’ AI-powered hacking campaign still required a ton of human work 

Anthropic made headlines Thursday when it released research claiming that a previously unknown Chinese state-sponsored hacking group used the company’s Claude AI generative AI product to breach at least 30 different organizations. According to Anthropic’s report, the threat actor was able to bypass Claude’s security guardrails using two methods: breaking up the work into discrete…

Google, researchers see signs that Lighthouse text scammers disrupted after lawsuit

The phishing kit Lighthouse, which has aided text scams like those soliciting victims to pay unpaid road tolls, appears to have been hampered shortly after Google filed a lawsuit aimed at its creators. Google said on Thursday that Lighthouse had been shut down. Two other organizations that have tracked the suspected Chinese operators of Lighthouse…

Chinese Hackers Use Anthropic’s AI to Launch Automated Cyber Espionage Campaign

State-sponsored threat actors from China used artificial intelligence (AI) technology developed by Anthropic to orchestrate automated cyber attacks as part of a “highly sophisticated espionage campaign” in mid-September 2025. “The attackers used AI’s ‘agentic’ capabilities to an unprecedented degree – using AI not just as an advisor, but to execute the cyber attacks themselves,” the…

Press Release: CIO100 and CSO30 ASEAN Awards 2025 Celebrate Regional Excellence in Technology Leadership

November 14, 2025: The CIO100 and CSO30 ASEAN and Hong Kong Awards Gala on November 12, 2025, delivered a powerful validation of the region’s technology leadership maturity. CIO ASEAN and CSO ASEAN had the privilege of hosting an evening that brought together the most elite CIO100 and CSO30 award winners, and technology teams from Singapore,…

Google Sues to Disrupt Chinese SMS Phishing Triad

Google is suing more than two dozen unnamed individuals allegedly involved in peddling a popular China-based mobile phishing service that helps scammers impersonate hundreds of trusted brands, blast out text message lures, and convert phished payment card data into mobile wallets from Apple and Google. In a lawsuit filed in the Southern District of New…

Google sues cybercriminal group Smishing Triad

Google sues China-based group using “Lighthouse” phishing kit in large-scale smishing attacks to steal victims’ financial data. Google filed a lawsuit against a cybercriminal group largely based in China that is behind a massive text message phishing operation, or “smishing.” The organization uses a phishing-as-a-service kit named “Lighthouse” to steal sensitive financial information by sending…

While White House demands deterrence, Trump shrugs

The Trump administration’s top cyber officials have emphasized the urgent need to take aggressive action to deter increasingly brazen foreign cyberattacks. Trump himself, however, has repeatedly brushed aside the notion that foreign cyber activity is anything even really noteworthy. When Trump’s team talks about foreign hacking, be it China’s alleged massive cyberespionage campaign against telecommunications…

 Google Sues China-Based Hackers Behind $1 Billion Lighthouse Phishing Platform

Google has filed a civil lawsuit in the U.S. District Court for the Southern District of New York (SDNY) against China-based hackers who are behind a massive Phishing-as-a-Service (PhaaS) platform called Lighthouse that has ensnared over 1 million users across 120 countries. The PhaaS kit is used to conduct large-scale SMS phishing attacks that exploit…

Australia’s spy chief warns of China-linked threats to critical infrastructure

Australia’s spy chief warns China-linked actors are probing critical infrastructure and preparing for cyber sabotage and espionage. Australia’s intelligence chief Mike Burgess warned that China-linked threat actors are probing critical infrastructure and, in some cases, have gained access. He said at least two Chinese state-sponsored groups are positioning themselves for future sabotage and espionage operations…

Meta’s SPICE framework pushes AI toward self-learning without human supervision

Meta researchers have unveiled a new reinforcement learning framework called SPICE (Self-Play in Corpus Environments) that enables large language models (LLMs) to improve their reasoning skills without human supervision. Developed with the National University of Singapore, SPICE trains a single model to act as both a Challenger, which generates complex, document-based problems, and a Reasoner, which solves…

$7.3B crypto laundering: ‘Bitcoin Queen’ sentenced to 11 Years in UK

“Bitcoin Queen” Zhimin Qian gets 11 years in London for laundering $7.3B from a crypto scam that defrauded 128K victims in China. A British court sentenced a Chinese woman, Zhimin Qian (47), also known as the “Bitcoin Queen,” to 11 years and eight months in jail for laundering $7.3B from a crypto scam that defrauded 128K…

Drilling Down on Uncle Sam’s Proposed TP-Link Ban

The U.S. government is reportedly preparing to ban the sale of wireless routers and other networking gear from TP-Link Systems, a tech company that currently enjoys an estimated 50% market share among home users and small businesses. Experts say while the proposed ban may have more to do with TP-Link’s ties to China than any…

China-linked hackers target U.S. non-profit in long-term espionage campaign

A China-linked group targeted a U.S. non-profit to gain long-term access, part of wider attacks on U.S. entities tied to policy matters. China-linked hackers breached a U.S. policy-focused nonprofit in April 2025, maintaining weeks of access. They used DLL sideloading via vetysafe.exe, a tactic used by other Chinese APT groups like Space Pirates, Kelp, and…

Congressional leaders want an executive branch strategy on China 6G, tech supply chain

Congressional leaders are pressing federal agencies to provide more information on their plans to compete with China on a range of tech and cybersecurity issues, including a strategy for promoting American 6G telecommunications infrastructure and limiting Chinese tech in US supply chains. Representative Raja Krishnamoorthi, D-Ill., ranking member on the House Select Committee on the…

U.S. sanctioned North Korea bankers for laundering funds linked to cyberattacks and peapons program

U.S. sanctions North Korea bankers and firms accused of laundering cybercrime funds used to finance the country’s nuclear weapons program. The U.S. Government has imposed sanctions on several North Korea bankers, financial institutions, and individuals accused of laundering funds obtained from cybercrime operations. According to the U.S. Treasury Department, these illicit financial activities directly support…

House GOP leaders seek government probe, restrictions on Chinese-made tech

A Commerce Department office should investigate Chinese government-connected products in more than a dozen emerging industries for security threats, a group of House GOP committee leaders said in a letter they released Wednesday. In the missive, the lawmakers said the Office of Information and Communications Technology and Services has the power to both investigate and…

Deeper Network Promo Deeper Network Promo Deeper Network Promo Image

North Korean companies, people sanctioned for money laundering from cybercrime, IT worker schemes

The Treasury Department on Tuesday sanctioned eight people and two companies it accused of laundering money obtained from cybercrime and IT worker schemes to fund North Korean government objectives. According to the department, over the last three years North Korea-linked cybercriminals have stolen over $3 billion, mostly in cryptocurrency. In addition, it said, North Korean…

China-linked UNC6384 exploits Windows zero-day to spy on European diplomats

A China-linked APT group UNC6384 exploits a Windows zero-day in an active cyber espionage targeting European diplomats. Arctic Wolf Labs researchers uncovered a cyber espionage campaign by China-linked APT UNC6384 targeting diplomatic entities in Hungary, Belgium, and other EU nations. UNC6384 is a China-nexus actor recently detailed by Google TAG, has expanded from targeting Southeast…

ICE Investigations, Powered by Nvidia

Nvidia, the computing giant that this week became the world’s first $5 trillion company, is powering U.S. Immigration and Customs Enforcement’s investigative division, according to federal records reviewed by The Intercept. This summer, ICE renewed access to software tools for use by Homeland Security Investigations, or HSI, an enforcement division previously tasked with transnational crime…

China-Linked Hackers Exploit Windows Shortcut Flaw to Target European Diplomats

A China-affiliated threat actor known as UNC6384 has been linked to a fresh set of attacks exploiting an unpatched Windows shortcut vulnerability to target European diplomatic and government entities between September and October 2025. The activity targeted diplomatic organizations in Hungary, Belgium, Italy, and the Netherlands, as well as government agencies in Serbia, Arctic Wolf…

Suspected Chinese actors compromise U.S. Telecom firm Ribbon Communications

A nation-state actor, likely a China-nexus one, hacked the U.S.-based technology company Ribbon Communications. Ribbon Communications is a U.S.-based technology company that provides telecommunications and networking. Ribbon Communications employs approximately 3,052 people as of December 31, 2024. The company reported annual revenue of US $834 million in 2024. The U.S. telecom provider disclosed a cyberattack…

US considers new software export curbs on China, threatening global tech supply chains

The US government is reportedly considering new export controls that could block a wide range of products made with US software from being shipped to China, in what could become one of Washington’s most sweeping trade measures to date. If implemented, the move could disrupt global technology supply chains and heighten uncertainty for multinational manufacturers…

Call to ban AI superintelligence could redraw the global tech race between the US and China

More than 850 prominent figures have called for a prohibition on developing AI superintelligence, a move that could reshape enterprise AI investments and intensify the US-China technology race if adopted. The open letter, released Wednesday by the Future of Life Institute, defined superintelligence as AI systems that “significantly outperform all humans on essentially all cognitive…

China-Linked Salt Typhoon breaches European Telecom via Citrix exploit

China-linked Salt Typhoon hacked a European telecom in July 2025 via a Citrix NetScaler Gateway exploit for initial access. A European telecom firm was targeted in July 2025 by China-linked APT group Salt Typhoon (also known as Earth Estries, FamousSparrow, GhostEmperor, UNC5807, RedMike)), which exploited a Citrix NetScaler Gateway to gain initial access. In late…

US NSA alleged to have launched a cyber attack on a Chinese agency

China’s claim that the US National Security Agency (NSA) was behind a cyber attack against the country’s timekeeping centre could be true, says an expert. “From a technical perspective, China’s allegation about an NSA hack on its national timekeeping center is plausible and aligns with known US cyber capabilities,”  Jeff Bardin, chief intelligence officer at…

China’s spy agency accuses NSA of yearslong attack on the country’s timekeeping service

China’s Ministry of State Security accused the National Security Agency of conducting a yearslong attack on China’s national timekeeping infrastructure to steal sensitive data and infiltrate the service for potential sabotage.  The NSA gained initial access to China’s National Time Service Center systems in April 2023 by using credentials lifted from employees’ mobile devices that…

China wirft den USA Cyberangriffe auf Zeitbehörde vor

China und USA werfen sich gegenseitig immer wieder Cyberangriffe vor. rawf8 – shutterstock.com China hat den USA Cyberangriffe auf eine zentrale staatliche Zeitbehörde vorgeworfen. Nach Angaben des Ministeriums für Staatssicherheit soll die US-Nachrichtendienstbehörde NSA seit März 2022 das Nationale Zeitdienstzentrum in Xi’an angegriffen haben. Die Angriffe hätten über Sicherheitslücken in den Handys von Mitarbeitern begonnen,…

China finds “irrefutable evidence” of US NSA cyberattacks on time Authority

China claims the US NSA hacked its National Time Service Center by exploiting staff phone flaws since March 2022, stealing sensitive data. China’s Ministry of State Security announced it has found “irrefutable evidence” that the US National Security Agency (NSA) conducted cyberattacks on its National Time Service Center, reports Bloomberg. The China National Time Service…

Winos 4.0 hackers expand to Japan and Malaysia with new malware

Winos 4.0 hackers expand from China, Taiwan to Japan, Malaysia using fake Finance Ministry PDFs to spread HoldingHands RAT malware. Threat actors behind Winos 4.0 (ValleyRAT) have expanded their attacks from China and Taiwan to Japan and Malaysia, using PDFs disguised as documents from the Finance Ministry to deliver malware. Attackers employed another remote access…

Deutschland größtes Hacker-Ziel in der EU

Laut einer Studie von Microsoft richteten sich 3,3 Prozent aller Cyberangriffe weltweit im ersten Halbjahr 2025 gegen Ziele in Deutschland. hyotographics – shutterstock.com Kein Land in der Europäischen Union steht so sehr im Fokus von kriminellen Hackern wie Deutschland. Das geht aus dem Microsoft Digital Defense Report 2025 hervor, den der Software-Konzern in Redmond veröffentlicht…

China-linked APT Jewelbug targets Russian IT provider in rare cross-nation cyberattack

China-linked APT Jewelbug targeted a Russian IT provider for five months in 2025, showing Russia remains exposed to Chinese cyber espionage. China-linked threat actor Jewelbug (aka CL-STA-0049, Earth Alux, and REF7707) carried out a five-month intrusion on a Russian IT service provider, marking its expansion beyond Southeast Asia and South America. The campaign, reported by…

Flax Typhoon APT exploited ArcGIS server for over a year as a backdoor

China-linked cyberespionage group Flax Typhoon hijacked an ArcGIS system for over a year and used it as a backdoor. China-linked APT group Flax Typhoon (aka Ethereal Panda or RedJuliett) compromised an ArcGIS system for over a year, using it as a backdoor. ArcGIS, a key GIS platform for mapping and analysis, supports vital services like…

CIO100 and CSO30 ASEAN 2025 Team Awards Finalists: Celebrating Technology and Cybersecurity Excellence Across the Southeast Asia region

SINGAPORE, October 13, 2025 Singapore’s premier technology leadership awards recognize groundbreaking innovations and transformative achievements ahead of spectacular Gala Night celebration. CIO and CSO ASEAN brands are delighted to announce the distinguished finalists for the CIO100 ASEAN and CSO30 ASEAN 2025 Team Awards, recognizing the region’s most innovative technology teams who are reshaping the future…

Open-source DFIR Velociraptor was abused in expanding ransomware efforts

Velociraptor, the open-source DFIR tool meant to hunt intruders, has itself gone rogue – being picked up by threat actors in coordinated ransomware operations. Never tied to extortion attacks before, the tool has been found to be abused by a China-based group, Storm-2603, previously known for exploiting Microsoft SharePoint vulnerabilities. Cisco Talos researchers first spotted…