New PlugX variant “Talisman” used by famous Chinese APT

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here PlugX is a well-known malware family with samples dating back to as early as 2008. A Chinese state-backed threat actor, RedFoxtrot group, is discovered to use a new variant of the PlugX malware, Talisman. The threat actor grou...

QingScan 跨站脚本漏洞

QingScan is a batch vulnerability mining tool by a Chinese daxia individual developer. It is used to glue various good scanners. There is a security vulnerability in QingScan 1.3.0, there is no information about the vulnerability at the moment, please feel free to pay attention to CNNVD or vendor...

Cannot input Simplified/Traditional Chinese or Japanese in Windows server 2019/2022 or Windows 10/11

For Windows Server 2019/2022 English OS or Windows 10/11 as VDA, CWA Windows Client uses Microsoft Pinyin IME to input simplified Chinese, Microsoft Bopomofo IME to input traditional Chinese, or Microsoft Japanese IME to input Japanese, keyboard sync mode is configured as "Sync only once" in...

PlugX: A Talisman to Behold

PlugX: A Talisman to Behold By Max Kersten, Marc Elias, Leandro Velasco, and Alexandre Mundo Alguacil · March 28, 2022 For over a decade, the PlugX malware has been observed internationally with different variants found around the world. This blog covers a PlugX variant that we have named Talisma...

PlugX: A Talisman to Behold

PlugX: A Talisman to Behold By Max Kersten, Marc Elias, Leandro Velasco, and Alexandre Mundo Alguacil · March 28, 2022 For over a decade, the PlugX malware has been observed internationally with different variants found around the world. This blog covers a PlugX variant that we have named Talisma...

FCC Adds Kaspersky and Chinese Telecom Firms to National Security Threat List

The U.S. Federal Communications Commission FCC on Friday moved to add Russian cybersecurity company Kaspersky Lab to the "Covered List" of companies that pose an "unacceptable risk to the national security" of the country. The development marks the first time a Russian entity has been added to th...

Experts Uncover Campaign Stealing Cryptocurrency from Android and iPhone Users

Researchers have blown the lid off a sophisticated malicious scheme primarily targeting Chinese users via copycat apps on Android and iOS that mimic legitimate digital wallet services to siphon cryptocurrency funds. "These malicious apps were able to steal victims' secret seed phrases by...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33122)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 has a command injection vulnerability, which originates from the component /goform/exeCommand fails to properly filter the construction of command special characters, commands, etc., which can be exploited by attackers to cause...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33121)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /goform/setAdInfoDetail fails to properly filter the construction of command special characters, commands, etc., and can be exploited by attackers to cause...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33118)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /goform/SetLanInfo fails to properly filter the construct command special characters, commands, etc., and can be exploited by attackers to cause arbitrary comma...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33115)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /cgi-bin/uploadAccessCodePic fails to properly filter the construction of command special characters, commands, etc., which can be exploited by attackers to cau...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33114)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /cgi-bin/uploadWeiXinPic to properly filter the construction of command special characters, commands, etc. An attacker could use this vulnerabili...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33113)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /goform/WriteFacMac to properly filter the construct command special characters, commands, etc. An attacker could use this vulnerability to cause...

Tenda M3 command injection vulnerability

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the failure of the component /goform/delAd to properly filter the construction of command special characters, commands, etc. An attacker could use this vulnerability to cause...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33117)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /goform/setPicListItem fails to properly filter the construct command special characters, commands, etc., and can be exploited by attackers to cause arbitrary...

Tenda M3 Command Injection Vulnerability (CNVD-2022-33120)

Tenda M3 is an access control from Tenda, a Chinese company. Tenda M3 is vulnerable to command injection, which stems from the component /goform/setFixTools fails to properly filter the construct command special characters, commands, etc., and can be exploited by attackers to cause arbitrary...

Chinese APT Combines Fresh Hodur RAT with Complex Anti-Detection

The Chinese advanced persistent threat APT Mustang Panda a.k.a. Temp.Hex, HoneyMyte, TA416 or RedDelta has upgraded its espionage campaign against diplomatic missions, research entities and internet service providers ISPs – largely in and around Southeast Asia. For one thing, the APT has deployed...

Chinese APT Hackers Targeting Betting Companies in Southeast Asia

A Chinese-speaking advanced persistent threat APT has been linked to a new campaign targeting gambling-related companies in South East Asia, particularly Taiwan, the Philippines, and Hong Kong. Cybersecurity firm Avast dubbed the campaign Operation Dragon Castling, describing its malware arsenal ...

New Variant of Chinese Gimmick Malware Targeting macOS Users

Researchers have disclosed details of a newly discovered macOS variant of a malware implant developed by a Chinese espionage threat actor known to strike attack organizations across Asia. Attributing the attacks to a group tracked as Storm Cloud, cybersecurity firm Volexity characterized the new...

Mustang Panda targets European diplomats using enhanced PlugX backdoor

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here Mustang Panda, a Chinese cyberespionage group, has been targeting European diplomats with a revised version of the PlugX backdoor in an ongoing campaign linked to the ongoing conflict in Ukraine. The group, also known as...