Field notes from the edge.
What our engineers learned this week. Hands-on technical deep-dives, postmortems, and strategy frameworks.
AIChina-Nexus Actor Spy on US Researchers Undetected for a Year
Google identified and stopped a year-long cyber espionage campaign by a China-linked threat actor that targeted US researchers. The attackers compromised RedCAP credentials to infiltrate multiple research institutions and exfiltrate sensitive data, remaining undetected throughout the extended operation.
AIChina-Linked JDY Botnet Expands to 1,500+ Devices for Cyber Reconnaissance
Cybersecurity researchers have identified a significant expansion of the JDY botnet, a China-linked covert network that has grown to over 1,500 compromised SOHO and IoT devices. The botnet operates as a centrally controlled scanning infrastructure designed to discover, fingerprint, and continuously map exposed services at scale for cyber reconnaissance purposes.
AIVerdantBamboo Deploys BSD Variant of BRICKSTORM on Linux Appliances
China-linked cyber espionage group VerdantBamboo has been observed deploying a BSD variant of the BRICKSTORM backdoor along with PLENET (GRIMBOLT) and AGENTPSD malware to target Linux systems. Volexity attributes this activity to VerdantBamboo, which overlaps with Microsoft's Clay Typhoon threat group. This represents an expansion of the threat actor's capabilities to target BSD and Linux-based ap
AIChina-Linked TA4922 Expands Phishing Attacks to UK, Germany, Italy, and South Africa
China-linked threat actor TA4922 has expanded its phishing campaign operations from initial targets to include organizations in the UK, Germany, Italy, and South Africa. The group demonstrates a rapid operational tempo and employs an evolving malware toolkit that includes ValleyRAT (Winos 4.0) and Atlas RAT (AtlasCross RAT) among other tools.