Integrity Technology Group, a government-linked Chinese firm, enables China-linked hackers to breach US and foreign networks, ten agencies said. The advisory treats the firm and its crews as one set of actors, so a single hunt can span sectors.
Perspective Coverage
14 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+12
- Incentives60
- Confidence74
Templated event invites and doctored posters lure Taiwan researchers into a live Google login relay
Cisco Talos says UAT-11985 used fake event invitations to phish Taiwanese research staff through a kit that relays Google logins and MFA challenges live. For the people those invitations target, the useful control is a second factor the relay cannot pass along.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives35
- Confidence55
Cisco Talos links China-nexus UAT-11587 to 16 affected or targeted institutions in eight Asian countries, via a backdoor run through Microsoft 365. Its commands move through Outlook and OneDrive via Microsoft Graph, so defenders have no command server to block.
Perspective Coverage
3 publishers
- Builder
- Builder 32%
- Operator
- Operator 63%
- Investor
- Investor 5%
Reality
- Evidence62
- Adoption30
- Hype gap+8
- Incentives
- Not scored
- Confidence65
Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence62
Volexity dates UTA0565's exploitation to September 3 and 4, five to six days before it first reported the chain publicly, delivered from typosquats of China Digital Times and the Center for American Progress and ending in a new implant it calls CLEANGULP.
Reality
- Evidence72
- Adoption58
- Hype gap+8
- Incentives52
- Confidence64
AI-written phishing fooled people 28% of the time in a BYU test, against 21% for human-written
In the same experiments, participants identified the author correctly 52% of the time. The strongest single lever the BYU team reports is a mention of a co-worker, worth 2.3 times the clicks of a generic sender.
Reality
- Evidence34
- Adoption
- Not scored
- Hype gap+33
- Incentives45
- Confidence44
Espionage crews exploited a Chrome flaw that Chromium had already fixed in public source
Proofpoint says a shared toolkit called BlueMoon chained two V8 flaws that Chromium had fixed in public but Chrome had not yet shipped, plus a Windows kernel bug that elevates only on older builds.
Reality
- Evidence62
- Adoption58
- Hype gap+18
- Incentives66
- Confidence58
buildOne report1 publisher Two Chinese actors hit Chrome with byte-identical shellcode before the Chromium fix shipped
Volexity says UTA0560 and JungleBamboo ran the same V8-to-kernel chain against separate targets on September 1, from separate infrastructure and with the same shellcode, while the V8 fix sat in Chromium source.
Publishers:volexity.com
Reality
- Evidence62
- Adoption58
- Hype gap+10
- Incentives60
- Confidence64