tag: China-Apt · 12 items
- Engineer — Act: ConnectWise Cloud Backup is widely deployed in enterprise and MSP environments; a confirmed supply chain compromise means you may have received tampered software. Audit ConnectWise Cloud Backup deployments for IOCs from Microsoft’s disclosure and check ConnectWise’s advisory for patched/clean versions to pin to.
- SOC/IR — Act: Storm-0940 supply chain compromise of a widely used backup tool creates a broad assumed-breach surface; hunt for lateral movement originating from ConnectWise processes and review Microsoft’s full disclosure for ARTEX-related IOCs and TTPs to sweep across your estate since the compromise window.
- Leader — Act: A confirmed China state-actor supply chain compromise of ConnectWise Cloud Backup is a board-level event; confirm whether your organization or any managed-service vendors use this product, request a written attestation from ConnectWise on scope and remediation, and brief leadership before they encounter this in the press.
- Engineer — Act: Active zero-day exploitation with a public PoC on GitHub and CVSS 9.3 — patch BeyondTrust Remote Support immediately and audit access logs for unauthorized sessions dating back to late August 2026.
- SOC/IR — Act: Armory Castle (China-nexus, formerly UNC5221) actively exploited this for remote support server takeover — hunt for anomalous sessions or lateral movement originating from BeyondTrust infrastructure since late August 2026 and sweep for any published IOCs from this campaign.
- Leader — Act: A China-linked espionage group used this as a zero-day against remote support servers — confirm whether your organization runs BeyondTrust Remote Support, request a vendor statement on incident scope and affected versions, and brief leadership before this surfaces in broader news coverage.
- Signals: CVE-2026-102764 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub, reported by 2 collected sources
- Engineer — Learn: The advisory describes website vulnerability scanning by Integrity Technology Group-linked actors but names no specific CVEs or software to patch; useful background on nation-state TTPs but no immediate engineering action is defined by the available summary.
- SOC/IR — Plan: A seven-country advisory on active email exfiltration targeting healthcare, government, and law enforcement warrants building or tuning detection coverage around unauthorized email access and lateral movement from edge devices; pull the full advisory for IOCs and ATT&CK mappings to queue a threat hunt.
- Leader — Learn: Sanctioned actor Integrity Technology Group’s campaign against healthcare and government institutions is relevant sector intelligence for risk registers and board briefings, particularly if your organization operates in Southeast Asia or shares infrastructure with targeted sectors.
- Engineer — Act: CVE-2015-3306 (ProFTPD, CVSS 10.0) carries EPSS 0.98, a public GitHub PoC, and active exploitation by a Chinese nation-state actor — patch ProFTPD immediately and audit all five KEV-listed CVEs before the October 11 federal deadline.
- SOC/IR — Act: Flax Typhoon is conducting live exploitation of these edge-service flaws; initiate a threat hunt for Flax Typhoon TTPs and sweep logs for ProFTPD anomalies (suspicious anonymous access, lateral movement from FTP services) since at least early October.
- Leader — Act: A Chinese nation-state actor is actively exploiting these vulnerabilities under a binding CISA directive with an October 11 deadline — confirm whether ProFTPD or the other four affected products are present in your environment and brief leadership given the geopolitical attribution and imminent compliance requirement.
- Signals: CVE-2015-3306 — CISA KEV: listed, EPSS 0.98, public PoC on GitHub
- Engineer — Act: Warlock is actively weaponizing both old and new SharePoint vulnerabilities to disable endpoint defenses and deploy ransomware; patch SharePoint to the latest available version immediately and audit recent access logs for exploitation artifacts.
- SOC/IR — Act: Two-vendor corroboration (Symantec and Carbon Black) of live ransomware deployments via SharePoint exploitation warrants a retroactive hunt for security-tool-kill events and SharePoint lateral movement patterns since at least early Q4 2026.
- Leader — Plan: Confirm SharePoint patch compliance with engineering this quarter and validate that endpoint-defense controls can detect tampering; current targeting is concentrated in Portuguese- and Spanish-speaking critical infrastructure, but the TTPs are sector-portable.
- Engineer — Act: Active exploitation of ZyXEL GS1900 switches and WordPress is confirmed with measurable data theft. Patch both to current versions immediately and audit backend database access logs and switch management interfaces for unauthorized access or lateral movement.
- SOC/IR — Plan: An active Chinese-attributed campaign is targeting ZyXEL switches and WordPress for database exfiltration, but the summary provides no specific IOCs. Build or tune detections for anomalous outbound queries from web servers and unauthorized switch management activity, and begin a retrospective hunt across those log sources.
- Leader — Plan: A Chinese-speaking actor has compromised nearly 1,000 devices and exfiltrated thousands of records in an ongoing government-targeting campaign. Confirm whether the organization runs ZyXEL GS1900 switches or internet-facing WordPress, and escalate to leadership if operating in sectors adjacent to government contracts.
- Engineer — Act: Actively exploited Chrome and Windows flaws (now patched) are being chained to deliver a JavaScript backdoor; verify that Chrome and Windows September 2026 security patches are fully deployed across your fleet immediately.
- SOC/IR — Act: Active UTA0560 spear-phishing campaign delivering the GRIMWEDGE JavaScript backdoor since September 1; hunt for associated IOCs from Volexity’s reporting and tune email gateway and endpoint detections for this campaign’s delivery patterns.
- Leader — Learn: A China-linked threat actor is running targeted spear-phishing against NGOs using a patched browser/OS exploit chain — notable for sector threat-awareness but not a systemic event requiring board action unless your organization is in the NGO space.
- Engineer — Skip
- SOC/IR — Learn: Adds to the UNC3569 actor profile and highlights input method editors as an under-monitored attack surface; no IOCs or ATT&CK mappings are published in this summary to drive immediate detection work.
- Leader — Skip
- Engineer — Learn: No specific exploited software, CVEs, or patches associated with QTFY’s platforms are named, so there is no concrete remediation action; file as context on Chinese state-sponsored tooling targeting critical infrastructure.
- SOC/IR — Plan: Research published TTPs and any emerging IOCs tied to QScan and QTRouter, then build or tune hunt queries targeting behaviors associated with QTFY activity before the actor pivots to new infrastructure post-disruption.
- Leader — Learn: Useful background for board or leadership briefings on nation-state threat trends; no specific vendor breach or near-term regulatory action is indicated, so no immediate escalation is warranted.
- Engineer — Act: CVE-2026-59310 (CVSS 9.8) is under active APT exploitation with a public PoC; patch VMware vCenter to the vendor-released fixed version immediately — do not wait for a maintenance window given confirmed in-the-wild exploitation.
- SOC/IR — Act: Assume-breach posture for any vCenter environment: hunt for signs of post-exploitation activity and Babuk-derived ransomware staging since the patch release date, and build detections around directory-traversal followed by unusual process spawning from vCenter services.
- Leader — Act: A China-nexus APT is actively deploying ransomware via a critical vCenter flaw — confirm whether your environment runs vCenter, verify patch status with your engineering team this week, and prepare a brief for leadership given the ransomware and nation-state dimensions.
- Signals: CVE-2026-59310 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
- Engineer — Plan: If your environment includes N-able N-central (common in MSP-managed or hybrid estates), apply any available patches and audit for signs of unauthorized remote execution; the vector is described as likely rather than confirmed, so no KEV urgency, but RMM tools are high-value pivot points.
- SOC/IR — Plan: Storm-1175 has shifted tooling from Medusa to a new C++ ransomware appending .encrypted; build or tune endpoint detections for that extension and ransomware-stage behaviors, and track this actor’s TTPs as Microsoft Threat Intelligence is actively reporting on the campaign.
- Leader — Plan: Confirm whether internal teams or managed service providers in your supply chain run N-central, and if so request a security posture attestation; a financially motivated China-linked actor deploying ransomware via RMM tooling is a credible MSP supply-chain risk worth queuing for this quarter’s vendor-risk review.
- Engineer — Learn: A newly documented Windows loader from a China-nexus cluster, but no specific vulnerable software, patch, or configuration action is identified — useful for understanding adversary tradecraft in government and healthcare environments.
- SOC/IR — Learn: Group-IB’s exposure of the JadeProx cluster and TriBack Loader provides actor-profile and malware-family context, but the summary lacks published IOCs or ATT&CK-mapped TTPs needed to build or tune detections immediately.
- Leader — Learn: China-nexus targeting of government and healthcare sectors in Asia and Latin America is worth tracking for sector-risk awareness, but no vendor breach or imminent regulatory trigger warrants same-week leadership action.