The Death of Software.

NO SAFE HAVEN. Working with our Dutch National Police partners, the FBI helped put an alleged leader of ShinyHunters—a global cybercrime threat actor—behind bars. And we’re not done. FBI teams are working new leads RIGHT NOW. More arrests are on the table. If you attack Americans from behind a keyboard anywhere in the world, we will find you. -DKP🇺🇸

src @canyie2977 已同意转发

这家IPdodo算是我看过最精美的翻墙路由器了 这个开模应该要花不少钱，而且他们的跨境专线合法合规 按月付费呢！ 四川威算科技有限公司

China has expanded overseas travel restrictions for top AI professionals in private firms to include the families of key personnel bloomberg.com/news/articles/…

While sweeping open directories on @etugenio, I came across a server in the US🇺🇸 on PEG TECH's network with port 8888 exposed. It wasn't a victim, but rather a box where a Chinese🇨🇳 speaking operator had left their entire offensive arsenal exposed to the internet. At the center of it was an AI-driven pentest framework. The operator calls it "Sinian." It organizes each attack technique into its own SKILL.md playbook, while sinian_pipeline.py chains them together into an autonomous attack pipeline. The same environment also hosts a plugin-based webshell C2 with modules for lateral movement, database dumping, SOCKS proxying, persistence, and log timestomping. The targets include Chinese payment and virtual-goods platforms such as tokenpay, dujiaoka, acg-faka, and epay, whose source trees were exposed through publicly accessible .git repositories. The attacks appear to rely on a ThinkPHP deserialization chain. Tooling targeting Shanghai health-card and Guangxi police-certificate systems also suggests that the operation extends into account-opening and real-name verification fraud. Stolen data is exfiltrated to a Telegram bot. Host: app.etugen.io/trashpile/104.… Content: Sinian AI pentest toolkit + webshell C2 + qingmeng-backdoor Exfiltration: Telegram bot Framework: CyberStrikeAI Exploits: CVE-2024-44902 - CVE-2025-63888 - phpggc Targets: tokenpay - dujiaoka - acg-faka - epay Fraud tooling: shanghai_health_card.py - guangxi_police_cert.py ATT&CK: T1059.004/.006 · T1552.003 · T1530 · Webshell #CTI #opendir #usa #china #war #hack #webshell

BREAKING: Chinese illicit actors laundering funds from the $387M Bitget exploit on behalf of the alleged DPRK attackers are openly asking for support with orders in public Discord servers and Telegram channels of services they use. Notably, Alias 4 (below) was also seen laundering funds from the Kelp DAO $292M exploit earlier this year. I've observed the same pattern after multiple TraderTraitor attributed exploits, and I've closely tracked these groups. I plan to share more of my data on them in coming weeks. Currently, funds are being chain-hopped via bridges and being deposited into mixing services such as Wasabi. Alias 1 - Cc Discord: cc02006 Discord ID: 1351486674386948148 Txn: F08657EFAEAE7B58217CD17A22BF4779582E5D080C2E92E173BC239A5D828363 Alias 2 - jack Discord: jack_34808 Discord ID: 1553705721768714377 Txn: 68583D313A0CCC99F2702D61D05A242A69C86CAE09ED252B65F34B677C377F69 Alias 3 - Melon Discord: under0346 Discord ID: 1394240539108573215 Txn 1: ABE2AEF8B10057E60F8259CA2CA2CD5D71D38D254960FEEE89CB3C95A964873F Txn 2: 7BE290865901DEB1680A6D692A11392D1FDDACA0D31C48F26DCB249F2444BD6B Alias 4 - lolo / Marin TG: pvpcz TGID: 6223514198 Discord: losern Discord ID: 1024415186527985704 Txn: 8E935C19D00F40639B78BF1FD094FE48C92118F3E586AB52DF93851080CCCE15 Alias 5 - HELP ME Discord: helpme031897 Discord ID: 1554035533817188384 Txn: 7C58CAD760EBBED54F2CA4D2146D056910B7B6688B4F524396DC8807353C2379

Eyal’s original finding is a good example of what defenders should assume is already happening: an attacker using autonomous AI agents against hundreds of online shops, with a reported average cost of around $25 per target. His follow-up now includes some nice additional work from @_ChezDaniela on the skimmer side of the campaign. Instead of chasing rotating C2 domains, she focused on more stable characteristics of the injected code and its packer - and expanded the hunt from one observed injection to 50+ shops. Her write-up goes into the details: medium.com/@ping.from.dani/o…