MI5 ‘very relaxed’ about proposed Chinese super-embassy in London

source: theguardian.com  |  image: pexels.com

 

Senior Security Service officers told Commons speaker in private meeting they can tackle espionage risks

 

MI5 officers told the House of Commons speaker at a private meeting that they can tackle the risks of a proposed Chinese super-embassy in London, opening the door to its approval.

The Guardian understands that in a meeting held with Lindsay Hoyle in the summer, senior figures from the Security Service indicated they were “very relaxed” about the prospect of a 20,000 sq metre embassy being constructed at Royal Mint Court near Tower Bridge.

It is considered that the espionage risks stemming from the large outpost can be managed. China has long had a diplomatic presence in the UK, with its existing embassy on Portland Place dating back over a century.

Keir Starmer is planning to travel to China for his first bilateral visit in January or February next year, according to several people briefed on the plans, but insiders believe that any trip is contingent on the embassy being greenlit next month.

In October, when asked about the espionage risk posed by the new embassy, Ken McCallum, the spy agency’s director general, indicated the Security Service believed the development was something it could deal with.

“MI5 has more than a century of experience of dealing with the national security risks, which do flow from the presence of foreign embassies on British soil,” he said. Continue reading “MI5 ‘very relaxed’ about proposed Chinese super-embassy in London”

US Think Tank Waves Red Flag Over Chinese Economic Espionage

image - china tech

source: technewsworld.com  |  image: pexels.com

 

A call to disrupt the People’s Republic of China’s economic espionage campaign against the United States was sounded in a new report by a Washington, D.C., technology think tank.

“China’s campaign of economic espionage against the United States spans cyber intrusions, insider theft, and technology transfer disguised as collaboration,” declared the report written by intelligence analyst and applied historian Darren E. Tromblay and published by the Information Technology & Innovation Foundation (ITIF).

“Washington must recognize that Beijing is operating an elaborate espionage ecosystem and take strategic measures to disrupt it,” it added.

China’s espionage ecosystem is systemic and strategic, it explained. From state intelligence agencies to nominally private firms, Beijing coordinates cyber, human, and corporate channels to steal U.S. industrial and defense technologies. Continue reading “US Think Tank Waves Red Flag Over Chinese Economic Espionage”

CROSSED WIRES: A CASE STUDY OF IRANIAN ESPIONAGE AND ATTRIBUTION

source: proofpoint.com  |  image: pexels.com

 

Key findings 

  • Between June and August 2025, Proofpoint began tracking a previously unidentified threat actor dubbed UNK_SmudgedSerpent targeting academics and foreign policy experts. 
  • UNK_SmudgedSerpent leveraged domestic political lures, including societal change in Iran and investigation into the militarization of the IRGC. 
  • UNK_SmudgedSerpent used benign conversation starters, health-themed infrastructure, OnlyOffice file hosting spoofs, and Remote Management & Monitoring (RMM) tools. 
  • Throughout the investigation, UNK_SmudgedSerpent demonstrated tactics resembling several Iranian actors: TA455 (C5 Agent, Smoke Sandstorm), TA453 (Charming Kitten, Mint Sandstorm), and TA450 (MuddyWater, Mango Sandstorm). 
  • Overlapping TTPs prevent high confidence attribution, but several hypotheses could explain the nature of the relationship between UNK_SmudgedSerpent and other Iranian groups. 

Overview  

In June, Proofpoint Threat Research began investigating a benign email discussing economic uncertainty and domestic political unrest in Iran. While coinciding with the escalations in the Iran-Israel conflict, there was no indication that the observed activity was directly correlated with Israel’s attacks on Iranian nuclear facilities or Iran’s actions in response. Continue reading “Crossed wires: a case study of Iranian espionage and attribution”

Chinese hackers infiltrated US Treasury Secretary’s PC — attackers had access to over 400 PCs

source: tomshardware.com (contributed by Steve Page)  |  image: pexels.com 

 

As reported last week, Chinese hackers infiltrated the U.S. Department of Treasury and gained access to several users’ workstations. However, according to Bloomberg, the infiltration was more severe than initially reported, as hackers managed to access systems belonging to Secretary Janet Yellen and other top officials.

European Government Air-Gapped Systems Breached Using Custom Malware

source: bleepingcomputer.com (contributed by FAN, Steve Page)  |  image: pexels.com

 

An APT hacking group known as GoldenJackal has successfully breached air-gapped government systems in Europe using two custom toolsets to steal sensitive data, like emails, encryption keys, images, archives, and documents.

According to an ESET report, this happened at least two times, one against the embassy of a South Asian country in Belarus in September 2019 and again in July 2021, and another against a European government organization between May 2022 and March 2024.

In May 2023, Kaspersky warned about GoldenJackal’s activities, noting that the threat actors focus on government and diplomatic entities for purposes of espionage.

Continue reading “European Government Air-Gapped Systems Breached Using Custom Malware”

Social engineering for espionage

and for profit

 

source: thecyberwire.com  |  image: pixabay.com

 

At a glance.

  • Okta discloses a data exposure incident.
  • Cisco works to fix zero-day.
  • DPRK threat actors pose as IT workers.
  • Five Eyes warn of AI-enabled Chinese espionage.
  • Job posting as phishbait.
  • The risk of first-party fraud.
  • The Quasar RAT and DLL side-loading.
  • Hacktivists trouble humanitarian organizations with nuisance attacks.
  • Content moderation during wartime.
  • Not content-moderation, but fact-checking.
  • Cyberespionage at the ICC.

Okta discloses a data breach.

Identity and access management company Okta has disclosed a data breach affecting some of the company’s customers. The company stated, “The threat actor was able to view files uploaded by certain Okta customers as part of recent support cases. It should be noted that the Okta support case management system is separate from the production Okta service, which is fully operational and has not been impacted. In addition, the Auth0/CIC case management system is not impacted by this incident.”

Continue reading “Social engineering for espionage and for profit”

China Accuses U.S. of Decade-Long Cyber Espionage Campaign Against Huawei Servers

 

source: thehackernews.com  |  image: pixabay.com

 

China’s Ministry of State Security (MSS) has accused the U.S. of breaking into Huawei’s servers, stealing critical data, and implanting backdoors since 2009, amid mounting geopolitical tensions between the two countries.

In a message posted on WeChat, the government authority said U.S. intelligence agencies have “done everything possible” to conduct surveillance, secret theft, and intrusions on many countries around the world, including China, using a “powerful cyber attack arsenal.” Specifics about the alleged hacks were not shared.

It explicitly singled out the U.S. National Security Agency’s (NSA) Computer Network Operations (formerly the Office of Tailored Access Operations or TAO) as having “repeatedly carried out systematic and platform-based attacks” against the country to plunder its “important data resources.”

Continue reading “China Accuses U.S. of Decade-Long Cyber Espionage Campaign Against Huawei Servers”

Officials found suspected Chinese malware hidden in various US military systems. Its intended use is disruption rather than surveillance, a ‘disturbing’ change in intent, experts say.

 

source: businessinsider.com  |  image: pexels.com

 

  • Suspected Chinese malware has been identified in several US military systems. 
  • Unlike other surveillance malware from China, this malware seems intended to disrupt operations.
  • The malware could also have the ability to disrupt normal civilian life and businesses.

US officials found suspected Chinese malware across several military systems — and unlike previous attacks, experts say the intent is more likely to disrupt rather than to surveil, The New York Times reports.

The attacks first came into the public eye in May after Microsoft identified malicious code in telecommunications software in Guam, where the US houses the Andersen Air Force Base.

Continue reading “Officials found suspected Chinese malware hidden…”

Clever Defiance

 

source: artoftheprank.com, contributed by Artemus FAN, Steve Jones  |  Image: Pixabay via pexels.com

 

An interesting footnote to the German occupation of France during WW II.
 
You might be aware that this year is the 100th anniversary of Citroën. Here’s a fascinating bit of wartime Citroën lore. It involves screwing with Nazis in a genuinely clever and subtle way that nevertheless had big repercussions. 
 
So, when France was occupied by the Germans in 1940, major French factories like Citroën were forced to produce equipment for the Nazis. Citroën president Pierre-Jules Boulanger knew he couldn’t just refuse to produce anything, but he also knew there’s no way in hell he’s going to just roll over and build trucks for a bunch of filthy Nazis. Pierre had a plan.  
 
John Reynold’s book Citroën 2CV describes Boulanger’s sabotage efforts. Of course, he instructed workers to set a nice, leisurely pace when building trucks (likely Citroën T45 trucks) for the Wehrmacht, but that’s fairly obvious. What was brilliant was Boulanger’s idea to move the little notch on the trucks’ oil dipsticks that indicated the proper level of oil down just a bit lower.
 
By moving the notch down, the trucks would not have enough oil, but German mechanics would have no idea, because the little notch on the dipstick says it’s just fine. 
 
Then, after the truck has been used for a while and is out deployed somewhere crucial, whammo, the engine seizes up and you’ve got a lot of angry, stranded, vulnerable Nazis, balling up their little fists and madly barking curses in German.
 
It’s such a fantastic act of sabotage: it’s extremely cheap to implement, it’s subtle, there’s no way to see something amiss is happening as the trucks are being built and it delivers its blow away from the site of the sabotage and when it will cause the most inconvenience and trouble.
 
That’s some mighty good sabotaging, Pierre.
 
Happy 100th Anniversary, Citroën!

FBI investigation details former CIA operative’s efforts to help Qatar’s World Cup bid, influence US policy

source: wfin.com  |  image: pexels.com

 

An FBI investigation into alleged unlawful activity to help Qatar obtain World Cup 2022 hosting privileges may have extended further to help improve Qatar’s image in the U.S. and influence U.S. policy, according to an Associated Press report.

The initial investigation focused on former CIA officer Kevin Chalker’s work to help Qatar through alleged foreign lobbying, surveillance and exporting sensitive information to undermine the country’s rivals in bidding for the World Cup, according to individuals with knowledge of the investigation.

Chalker’s company Global Risk Advisors employed a number of methods, such as a Facebook “honeypot” trap, in which an attractive woman connected with a target, or someone posed as a photojournalist to keep tabs on one nation’s bid.

Continue reading “FBI investigation details former CIA operative’s efforts…”