13 casos · pág. 1/1
Google warns that Armory Castle, a suspected PRC state-sponsored espionage actor, exploited the critical BeyondTrust Remote Support vulnerability CVE-2026-102764 (CVSS 9.3) in August 2026, well before BeyondTrust disclosed it on October 15. The actor escalated privileges to root and established persistent access on compromised appliances.…
The U.S. Department of Homeland Security (DHS) has issued an order requiring federal civilian agencies to stop using DeepSeek products and remove them from government systems. The order also covers products from DeepSeek's affiliates and third-party products or services built on DeepSeek technology. DHS cites concerns that the Chinese gov…
The US Department of Homeland Security (DHS) has ordered federal civilian agencies to stop buying DeepSeek products and services and to remove them from government IT systems, citing national security concerns. The order also covers third-party products and services built on DeepSeek technology, though agencies may request exceptions. DHS…
The U.S. Department of Homeland Security (DHS) has issued a Federal Acquisition Supply Chain Security Act (FASCSA) order directing federal civilian agencies to remove DeepSeek AI products from their IT systems and to stop acquiring them. The notice is due to be published in the Federal Register on October 20, 2026 and names Hangzhou DeepS…
The US Department of Homeland Security issued an order directing federal civilian agencies to stop using products from Chinese AI lab DeepSeek and to remove existing implementations. The order also covers "DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations." That wording is vague an…
The Department of Homeland Security is barring civilian federal agencies from buying or using IT products and services from Hangzhou DeepSeek Artificial Intelligence and its affiliates. The notice, due in the Federal Register, cites the Federal Acquisition Supply Chain Act and a review by the Federal Acquisition Security Council. An accom…
A joint advisory (AA26-281A) attributes China-based malicious cyber activity to Integrity Technology Group (Integrity Tech), a for-profit company with links to the Chinese government. The company builds and sells tools, hosts infrastructure and compromises networks worldwide. The actors' TTPs are consistent with Flax Typhoon, Ethereal Pan…
Mandiant and GTIG attribute exploitation of the critical BeyondTrust Remote Support zero-day CVE-2026-102764 to Armory Castle (formerly tracked as UNC5221), a likely Chinese government-backed espionage group. BeyondTrust dates the first known exploitation to Aug. 29 and says it detected and contained the activity Sept. 28. Only a small nu…
X said it removed more than 13,000 accounts involved in three suspected foreign influence operations targeting US political debate ahead of the 3 November 2026 US midterm elections. The platform linked the operations to Iran, Russia and China. It said the networks used inauthentic accounts to post and amplify political content aimed at ca…
This Foreign Affairs essay, co-written by Bruce Schneier and Seva Gunitsky, argues that AI offers autocrats two things: real-time monitoring of subordinates and replacement of human intermediaries. Examples include RT's AI-generated anchors, China's Zero Trust AI system and smart city oversight, Russia's Oculus censorship system and Melio…
GreyNoise reports that a single malicious cyber actor, tracked since 7 May 2026, is a suspected Chinese speaker working in UTC+8 and is the same as or related to Red Heron (reported by Acronis), based on the shared C2 domain, malware family, Gitea exploitation and other TTPs. The actor exploited the wp2shell WordPress chain (CVE-2026-6303…
This weekly recap covers several concurrent incidents. ConnectWise disabled seven application identities and suspended Cloud Backup after unknown actors abused them to compromise Microsoft 365 tenants. China-nexus Armory Castle (UNC5221 / Warp Panda) exploited BeyondTrust Remote Support flaw CVE-2026-102764 (CVSS 9.3) as a zero-day in lat…
TrendAI™ (Trend Micro) published its H1 2026 APT Activity Roundup on July 29, 2026. It finds nation-state actors used AI in more stages of the intrusion lifecycle than in any prior half-year the company has tracked. China-aligned actors used generative AI to refine exploits and iteratively build malware through "vibe coding", and one AI a…
