Nation-State
Google’s Threat Intelligence Group has been tracking the cyberespionage group as UNC6508 since early 2025.
Hi, what are you looking for?
SecurityWeek
All posts tagged "China APT"
Malware & Threats
Salt Typhoon has hit an energy entity in Azerbaijan. Twill Typhoon has targeted Asian entities with an updated RAT.
Nation-State
The cybersecurity firm has not explicitly accused China of being behind the attack, but the evidence suggests it was.
Malware & Threats
Dubbed GopherWhisper, the group relies on multiple Go-based backdoors alongside custom loaders and injectors.
Nation-State
The state-sponsored threat actor deployed kernel implants and passive backdoors enabling long-term, high-level espionage.
Nation-State
The state-sponsored hackers deployed custom tools and stayed dormant in the compromised environments for months.
Malware & Threats
The UNC2814 threat actor has been active since at least 2017, targeting organizations across 42 countries.
Nation-State
The vulnerability in TeamT5 ThreatSonar Anti-Ransomware was recently added to CISA’s KEV catalog.
Malware & Threats
GTIG and Mandiant said the zero-day tracked as CVE-2026-22769 has been exploited by UNC6201 since at least 2024.
Malware & Threats
China-linked UNC3886 targeted all four major telecom providers, but did not disrupt services or access customer information.
Malware & Threats
Palo Alto Networks has not attributed the APT activity to any specific country, but evidence points to China.
Malware & Threats
The threat actor uses a signed driver file containing two user-mode shellcodes to execute its ToneShell backdoor.
Cyberwarfare
The British government is investigating a “cyber incident” following news reports that hackers linked to China have gained access to thousands of confidential documents.
Malware & Threats
The hacking group has been using Group Policy to deploy cyberespionage tools on governmental networks.
Malware & Threats
The critical zero-day is tracked as CVE-2025-20393 and it impacts Secure Email Gateway and Secure Email and Web Manager appliances.
Malware & Threats
Google has also mentioned seeing React2Shell attacks conducted by Iranian threat actors.
Malware & Threats
Warp Panda has been using the BrickStorm, Junction, and GuestConduit malware in attacks against US organizations.
Malware & Threats
APT24 has been relying on various techniques to drop the BadAudio downloader and then deploy additional payloads.
Nation-State
A Chinese threat actor is exploiting known vulnerabilities in discontinued Asus devices in an Operational Relay Box (ORB) facilitation campaign.
Artificial Intelligence
A state-sponsored threat actor manipulated Claude Code to execute cyberattacks on roughly 30 organizations worldwide.
Data Breaches
The WorldLeaks extortion group claimed to have stolen 720 GB of data from the healthcare testing and laboratory services provider.
Artificial Intelligence
Vulnerabilities
Artificial Intelligence
Vulnerabilities
Threat actors have been targeting Balbooa Forms and iCagenda Joomla extension flaws for remote code execution.
