Author: Staff Writer

Quick Takeaways OpenAI has confirmed that a ChatGPT account linked to Chinese law enforcement was used to plan and document large-scale covert cyberattack campaigns targeting dissidents, foreign officials, and critics of the Chinese Communist Party. These operations, dubbed “Cyber Special Operations,” involved over 300 social media platforms, thousands of fake accounts, and hundreds of operators across China, aiming to manipulate public opinion and suppress dissent globally. The threat actor used AI tools—including ChatGPT, DeepSeek-R1, Qwen2.5, and YOLOv8—to design influence campaigns, with documented efforts to target Japanese politician Sanae Takaichi and other dissidents through disinformation and fabricated documents. OpenAI urges social…

Top Highlights A publicly released proof-of-concept (PoC) exploit demonstrates that CVE-2026-2636, a Windows CLFS driver vulnerability, allows low-privileged users to crash systems with a kernel-level Blue Screen of Death (BSoD). The vulnerability arises from improper flag validation in the CLFS.sys driver, specifically within the ReadLogPagingIo function, which can trigger a system crash through manipulated I/O request flags. The exploitation is straightforward, requiring only two API calls—CreateLogFile and ReadFile—making it accessible even to less-skilled attackers and posing a significant DoS threat across enterprise environments. Microsoft silently patched this flaw in September 2025 updates for newer Windows versions; however, older versions like…

Essential Insights A Chinese state-linked hacking group, UNC2814, has been operating for nearly a decade, breaching telecom and government targets across 42 countries using sophisticated methods, notably a backdoor called GRIDTIDE that communicates via Google Sheets to evade detection. Google and Mandiant disrupted this global espionage campaign by identifying and severing the group’s persistent access, revealing that the operation targeted sensitive information, including personal identifiers and data aligned with Chinese intelligence priorities. The malware, GRIDTIDE, hides within legitimate system tools, establishes encrypted channels via SoftEther VPN, and exfiltrates data by encoding traffic through Google Drive spreadsheets, making traditional defenses ineffective.…

Essential Insights Launch of AI Management Dashboard: Link11 introduces a new solution to enhance visibility and control over AI-driven internet traffic, addressing the growing challenges organizations face with AI crawlers. Strategic Challenge: AI traffic has evolved into a crucial issue for security and governance, requiring organizations to accurately identify and manage AI access to their content. Enhanced Insights and Control: The dashboard separates AI traffic from general bot activity, providing detailed analytics and enabling organizations to understand patterns, trends, and individual AI tool interactions for better decision-making. Seamless Integration: Operating within Link11’s existing platform, the dashboard offers a straightforward way…

Summary Points Steaelite is an advanced malware-as-a-service tool that consolidates remote access, credential harvesting, data exfiltration, and ransomware deployment into a single dashboard, making cyber attacks more efficient and scalable. It includes modules for remote code execution, live streaming, webcam/microphone access, process management, and targeted attacks like DDoS and RDP access, turning infected systems into persistent surveillance and control platforms. The tool’s capability for double extortion—harvesting data before deploying ransomware, with potential Android ransomware modules—poses a new level of threat to businesses, allowing comprehensive compromises from a single license. Cyber defenders should prioritize preventing data exfiltration, as Steaelite’s design assumes…

Summary Points Critical Vulnerabilities: Anthropic’s AI coding tool, Claude Code, had three severe security vulnerabilities, exposing developers to risks like machine takeover and credential theft upon opening project repositories. Remediation and Awareness: Anthropic addressed these issues after Check Point Research’s disclosure and urges developers to utilize the latest version of Claude Code for improved security. Automation vs. Security: The discovered flaws reveal challenges in balancing automation and security in development tools, allowing malicious commands to execute unnoticed through project configuration files. Broader Risks: The vulnerabilities highlight the extensive risks introduced by AI tools that have direct access to code, emphasizing…

Fast Facts SURXRAT is a sophisticated Android Remote Access Trojan (RAT) sold via Malware-as-a-Service on Telegram, enabling cybercriminals to easily distribute and customize the malware with tiered licensing. It employs advanced modular architecture, utilizing social engineering and abuse of Android Accessibility Services to gain persistent, stealthy control over infected devices, including sensitive data exfiltration. The malware integrates ransomware-like device locking, allowing attackers to extort victims by preventing device access and monitoring unlock attempts, blending espionage with extortion tactics. Defending against SURXRAT requires strict source validation, cautious permission granting, multi-factor authentication, and keeping devices updated with security solutions to detect and…

Essential Insights VulnCheck has joined the Operational Technology Cybersecurity Coalition (OTCC) to enhance threat intelligence and safeguard critical infrastructure against increasingly sophisticated attacks on OT environments. The collaboration aims to leverage VulnCheck’s real-time exploit intelligence to inform public policy, improve vulnerability prioritization, and strengthen defenses for industrial control systems and network-edge devices. The OTCC emphasizes an open, vendor-neutral approach to secure critical infrastructure, promoting information sharing and policy development based on current threat activity. VulnCheck’s platform analyzes over 500 million CVE records daily, providing actionable, machine-readable exploit data to help organizations swiftly identify and respond to active vulnerabilities. Underlying Problem…

Fast Facts Despite over 40,000 vulnerabilities published in 2025, only 1% (just 422) were exploited in the wild, highlighting the challenge of effective prioritization amid such volume. Attackers predominantly target network edge devices, which account for 28% of impacted products, due to their privileged role in network access and outdated software bases. The top exploited vulnerabilities, including those in Microsoft SharePoint, React, and other major vendors, were linked to multiple threat groups and ransomware, with some like React2Shell having over 236 exploits shortly after disclosure. The report emphasizes that technology as a whole is the core issue, stressing the urgent…

Fast Facts An urgent security update (Serv-U v15.5.4) addresses four critical vulnerabilities with CVSS scores of 9.1, allowing remote code execution and full system compromise. These flaws, including broken access control, type confusion, and IDOR, enable attackers to gain root privileges and create unauthorized admin accounts remotely. Exploit of these vulnerabilities could lead to ransomware deployment, data theft, or persistent backdoors within affected networks. The update introduces platform support for Ubuntu 24.04 LTS, enhanced security features, and must be urgently applied to prevent potential exploitation. Underlying Problem Recently, SolarWinds issued an urgent security update for their Serv-U file server software,…