Search: “deserialization”

14 stories

China-linked campaign used the SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to automate intrusions against government targets in Taiwan, Indonesia, China and Vietnam.

Hunt.io documented a second China-linked campaign wiring commercial AI models into live cyberespionage, reconstructing the SecFlow orchestration system from five accidentally exposed open directories. Targets included Taiwan's Kuomintang Party archives, Indonesia's Ministry of Foreign Affairs, mainland Chinese government and education systems, and Vietnamese industrial hosts. The most extensive compromise hit a Fengtai District government Office Automation environment, yielding LSASS and registry hive theft, 822 user records and 1.28GB of attachments including patient health data. Tooling included a GLUTTON webshell hiding payloads in PNG pixels via steganography and a fake MySQL deserialization service for client-side code execution.

Security AffairsSep 4, 11:00 UTC · 13d agoThreat actor in the wild

AWS: China-linked threat actors weaponized React2Shell hours after disclosure

Security AffairsDec 8, 13:37 UTC · Dec 8, 2025Threat actor in the wildCVE-2025-55182 CVE-2025-1338

Multiple threat actors exploited Progress Telerik bug to breach U.S. federal agency

Security AffairsMar 16, 10:58 UTC · Mar 16, 2023Threat actor CVE-2019-18935

H1 2026 Malware Vulnerability Trends

Recorded Future's H1 2026 report finds 215 actively exploited CVEs, RAT dominance, NFC payment fraud, and AI-augmented but not autonomous tradecraft.

Recorded Future's Insikt Group identified 215 actively exploited CVEs in H1 2026, up 34% from 161 in H1 2025, with the most impactful flaws combining network reachability, no authentication, and code execution. AsyncRAT was the top malware family, with AsyncRAT, Cobalt Strike, XWorm, Stealc, and REMCOS remaining top-ten staples; Android NFC malware like NFCShare and NGate enabled payment card theft and ATM cash-outs. AI-enabled attacks remained additive to established tradecraft, concentrated in Levels 1-3 of Recorded Future's AIM3 maturity model, with AI-assisted vulnerability research (e.g., Claude Mythos fixing 271 Firefox bugs in Firefox 150) inflating NVD disclosure volumes 43% above the prior six-month average. The report urges defenders to prioritize remotely exploitable RCE flaws, behavioral detection, developer credential security, and third-party oversight.

Recorded FutureSep 3, 00:00 UTC · 14d agoThreat actor in the wild1

Chinese threat actors exploited Trimble Cityworks Flaw to breach U.S. local government networks

Security AffairsMay 23, 06:27 UTC · May 23, 2025Threat actor in the wildCVE-2025-0994 CVE-2025-09441

Chinese APT41 Hackers Broke into at Least 6 U.S. State Governments: Mandiant

The Hacker NewsMar 15, 00:00 UTC · Mar 15, 2022Threat actor CVE-2021-44207 CVE-2021-44228

Chinese APT41 Group Compromises Six US Government Networks

Infosecurity MagazineMar 9, 09:30 UTC · Mar 9, 2022Threat actor

Vishing Makes Phishing Campaigns Three Times More Successful

Infosecurity MagazineFeb 24, 10:00 UTC · Feb 24, 2022Threat actor CVE-2021-35464 CVE-2019-19781 CVE-2021-44228

Threat actors scan Internet for Vulnerable Microsoft Exchange Servers

Security AffairsFeb 27, 08:05 UTC · Feb 27, 2020Threat actor CVE-2020-0688