57
China-linked Fire Ant Hides Inside Trusted Infrastructure
China-linked Fire Ant backdoored Cisco IOS XR routers, injected TACACS libraries to steal credentials, and rewrote logs across infrastructure targets.
Sygnia reports the China-linked espionage group Fire Ant compromised Cisco IOS XR routers with purpose-built malware, injected a library into the TACACS authentication daemon to capture live credential material, and manipulated syslog so only messages containing 'Health' were logged. The group used GRE tunnel interfaces with no commit history, rewrote wtmp/utmp/btmp login records, and deployed dormant deep backdoors on Linux systems — one disguised as a SentinelOne agent, another activated by raw network traffic carrying a magic string. Code-level overlap with UNC3886 tooling suggests evolution of that China-nexus cluster's TACACS credential-collection techniques, and Fire Ant used compromised infrastructure to scan SSH, RDP and web ports toward high-value networks.
74
FBI takes down China-linked hacking network behind attacks on NASA, DOJ and U.S. Senate
FBI seized domains disabling QScan and QTRouter malware run by China-linked QTFY group behind intrusions at NASA, DOJ, Senate and other agencies.
The Justice Department and FBI seized domains hard-coded into two malware tools, QScan and QTRouter, operated by a Chinese state-sponsored group called QTFY, tied to a Nanjing-based company that sold hacking services to China's Ministry of State Security and the PLA. QScan infected IoT devices worldwide while QTRouter combined them with commercial proxies and rented servers to build an obfuscation network that masked attack origins. Victims include NASA, the Federal Reserve, the Departments of Energy and Justice, HHS, NIH, and the U.S. Senate. The FBI and NSA published a joint advisory with indicators of compromise, the latest in operations against Mustang Panda, Flax Typhoon, and Volt Typhoon infrastructure.
80
One Attacker Has Scraped Both Salesforce and ServiceNow Portals Since 2025
Reco tracks the City Forum campaign: one Contabo VPS has scraped Salesforce and ServiceNow guest portals across finance, telecom and public sector since March 2025.
Reco researchers identified infrastructure at 158.220.87.79, a Contabo VPS using Go's default net/http user agent, that has harvested records from Salesforce Experience Cloud and ServiceNow customer portals across telecom, financial services, enterprise software and public sector targets for over a year. The tool abuses over-privileged persistent guest users, enumerating Salesforce Aura sites (560,000+ events at one target), probing Lightning Web Runtime via the UI-API across API versions v56.0-v66.0, and hitting the poorly documented ServiceNow Service Portal search endpoint. No named victims or actor attribution yet, and activity is ongoing with rising volume. Defenders are advised to hunt the Go-http-client user agent and specific IP in Salesforce Event Monitoring logs and syslog_transaction on ServiceNow, then tighten guest sharing rules and Knowledge Base read criteria.
68
60
57
57
57
57
57
60
57
57
57
57