60
60
60
60
60
60
60
60
60
60
60
60
CISA Warns of CrushFTP Vulnerability Exploitation in the Wild
60
60
CISA adds Cisco ASA and FTD and CrushFTP VFS flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
U.S. CISA adds CrushFTP, Google Chromium, and SysAid flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
⚡ Weekly Recap: SharePoint 0-Day, Chrome Exploit, macOS Spyware, NVIDIA Toolkit RCE and More
60
Warning: 3 Critical Vulnerabilities Expose ownCloud Users to Data Breaches
60
60
60
Week in review: Probing activity on Palo Alto Networks GlobalProtect portals, Patch Tuesday forecast
60
60
60
FBI Disrupts China-Linked QTFY Infrastructure Used to Steal Data From U.S. Organizations
FBI and Lumen disrupted QTFY's QScan and QTRouter botnet platforms used by Chinese state-sponsored hackers to conceal intrusions into U.S. agencies.
The U.S. DoJ announced court-authorized seizure of domains behind QScan and QTRouter, operated by the Chinese state-sponsored group QTFY and employed by Nanjing Xinjiuwei Network Technology Company. QTFY has been active since May 2018 and targeted NASA, the Federal Reserve, the Department of Energy, DoJ, HHS, NIH, the U.S. Senate, and academic institutions. QScan exploits vulnerable IoT devices, feeding them into QTRouter, an OpenWrt-based proxy obfuscation network likened to an operational relay box (ORB) that masks attack origins. The group exploited zero-days such as Ivanti CSA flaws CVE-2024-8190, CVE-2024-8963, and CVE-2024-9380, plus numerous N-days, and maintained persistence with RATs, web shells, and legitimate credentials.
78
Officials disrupt Chinese espionage operation that hit multiple federal agencies
FBI and DOJ seized QTFY infrastructure, disrupting a Chinese state-sponsored group that compromised federal agencies and critical infrastructure since 2018.
Authorities seized three domains powering QScan and QTRouter, the hacking suite of QTFY, a Chinese government-funded group operating through front company Nanjing Xinjiuwei Network Technology. Targets include the Departments of Energy, Justice, and Health and Human Services, the Federal Reserve, NASA, NIH, financial institutions, defense contractors, utilities, telecoms, and hospitals; the group exploited zero-days in Ivanti, Pulse Secure, Fortinet, Citrix, and others, intruding three DOE national labs in September 2024. QScan carried over 200 proof-of-concept exploits and processed more than two million scanning tasks in a single day in 2024.
88
FBI Seizes China-Linked Hacking Platforms QScan and QTRouter Used Against Critical Infrastructure
FBI seizes China-linked QScan and QTRouter hacking platforms used by QTFY to obfuscate intrusions against US federal agencies.
The DOJ and FBI seized domains hard-coded into QScan and QTRouter, two platforms operated by China-based Nanjing Xinjiuwei Network Technology Company on behalf of state-sponsored group QTFY. QScan automatically infected thousands of IoT devices which were added to QTRouter, an obfuscation network routing malicious traffic through compromised and proxy devices outside China. Targets included NASA, the Federal Reserve, Departments of Energy, Justice, and HHS, NIH, and the US Senate, exploiting flaws in Fortinet SSL-VPN, Citrix ADC, Microsoft Exchange, F5 BIG-IP, Log4j, and others.
78
Storm-1175 Replaces Medusa With New StormEncryptor Ransomware
Microsoft reports China-linked ransomware group Storm-1175 switched from Medusa to a new C++ strain, StormEncryptor, likely exploiting N-able flaw CVE-2026-18577.
Microsoft Threat Intelligence reports that the financially motivated, China-linked group Storm-1175 began deploying a new ransomware strain called StormEncryptor on August 2, 2026, replacing its previous Medusa ransomware. StormEncryptor is written in C++, appends the .encrypted extension to files, and drops a !!!README_FIRST!!!.txt ransom note in each scanned directory. Microsoft assesses the group is likely exploiting CVE-2026-18577, an authentication bypass in N-able disclosed on August 2, 2026 and added to CISA's Known Exploited Vulnerabilities catalog the next day. Since 2023, Storm-1175 has exploited more than 16 vulnerabilities in products including Microsoft Exchange, Ivanti, ConnectWise ScreenConnect, JetBrains TeamCity, SimpleHelp, CrushFTP, and GoAnywhere MFT, often moving from initial access to data theft and ransomware deployment within days.
62
Fast-moving Storm-1175 uses new exploits to breach networks and drop Medusa
60
60
60
60
CLOP targets Gladinet CentreStack servers in large
60
60
60