CL-STA-0048: China-Nexus Espionage Cluster
CL-STA-0048 is a China-nexus espionage cluster that has been linked to the exploitation of SAP NetWeaver vulnerabilities, including CVE-2025-31324.
Tag: China
UNC5221: China-Nexus Espionage Cluster
UNC5221 is a China-nexus espionage cluster that has been observed exploiting SAP vulnerabilities, including CVE-2025-31324, to compromise targets. The group is known…
Moonshot AI Accused of Claude Capability Extraction
Moonshot AI is one of three Chinese firms accused by Anthropic of running industrial-scale campaigns to extract Claude's capabilities for their own…
MiniMax Accused of Claude Capability Extraction
MiniMax is another Chinese firm accused by Anthropic of illegally extracting Claude's capabilities to improve its own models.
Zhejiang Fengwo IoT Technology: Attributed to Fuyao Operation
Zhejiang Fengwo IoT Technology Co., Ltd. is a mainland China company founded in 2019, attributed by Bitsight to the Fuyao ad fraud…
CNCERT: China’s National Computer Network Emergency Response Technical Team
CNCERT is China's national computer emergency response team. It jointly tracks the Dysphoria IoT botnet with XLab and published analysis on its…
QAX: Chinese Cybersecurity Firm
Chinese security company whose Xingtu Lab contributed to the research on Android AI agent vulnerabilities.
FOFA Asset Search Engine
A Chinese asset-search service whose key was found alongside the Hermes agent's web interface password on the staging server.
UAT-7810: Chinese APT Expanding ORB Networks
UAT-7810 is a Chinese advanced persistent threat (APT) actor responsible for maintaining and proliferating LapDogs, an Operational Relay Box (ORB) network. The…
UAT-5918: China-Nexus Threat Actor Targeting Taiwan Critical Infrastructure
UAT-5918 is a China-nexus threat actor that has leveraged ORB networks maintained by UAT-7810 to conduct cyber attacks targeting critical infrastructure entities…