Tag: chinese threat actors

6 Attack Reports | 0 Vulnerabilities

Attack reports

ToolShell Exploit: Critical SharePoint Zero-Day Threatens Global Enterprises

A zero-day exploit chain named 'ToolShell' is actively targeting on-premises Microsoft SharePoint servers worldwide, potentially affecting thousands of organizations. The attack leverages two critical vulnerabilities (CVE-2025-53770 and CVE-2025-53771) to achieve remote code execution and steal cry…

chinese threat actors

in-memory payload

cryptographic keys

Published: August 14, 2025

Linked vulnerabilities : CVE-2025-53770 (CVSS 9.8), CVE-2025-53771 (CVSS 7.1), CVE-2025-49704, CVE-2025-49706

Downloadable IOCs: 8

SharePoint Zero-Day Exploit (ToolShell) - Network Infrastructure Mapping

Chinese threat actors have been exploiting zero-day vulnerabilities in SharePoint servers, known as ToolShell, affecting nearly 150 organizations worldwide. The attacks, attributed to groups like Linen Typhoon and Violet Typhoon, began as early as July 17, 2025, targeting government agencies, criti…

chinese threat actors

cloud infrastructure

warlock ransomware

network mapping

telecommunication abuse

Published: August 2, 2025

Downloadable IOCs: 0

Exploits Cityworks zero-day vulnerability to deliver malware

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management…

chinese threat actors

Published: May 22, 2025

Linked vulnerabilities : CVE-2025-0944 (CVSS 6.3)

Downloadable IOCs: 18

Smishing Triad: Chinese eCrime Group Targets 121+ Countries, Introduces New Banking Phishing Kit

The Chinese eCrime group Smishing Triad has launched a global SMS phishing campaign targeting over 121 countries across various industries. Their infrastructure generates over one million page visits in 20 days, averaging 50,000 daily. The group has introduced a new 'Lighthouse' phishing kit focusi…

chinese threat actors

global campaign

Published: April 10, 2025

Downloadable IOCs: 93

ToxicPanda: a new banking trojan from Asia hit Europe and LATAM

A new Android banking Trojan called ToxicPanda has emerged, targeting Europe and Latin America. Originating from Chinese-speaking threat actors, it has infected over 1500 devices across Italy, Portugal, Spain, and other countries. ToxicPanda exploits accessibility services for account takeovers and…

c2 infrastructure

chinese threat actors

on-device fraud

accessibility abuse

Published: November 6, 2024

Downloadable IOCs: 19

Threat Intelligence Alert: Phish 'n' Ships Fakes Online Shops to Steal Money and Credit Card Information

A sophisticated fraud scheme dubbed 'Phish 'n' Ships' has been uncovered, involving fake web shops that exploit digital payment providers to steal consumers' money and credit card information. The operation, traced back to 2019, has infected over 1,000 websites, created 121 fake web stores, and res…

chinese threat actors

credit card theft

fake web stores

payment processor abuse

search engine manipulation

e-commerce fraud

Published: October 31, 2024

Downloadable IOCs: 22

Click here to see more Attack Reports