Risky Bulletin: Chinese APT uses SS7, Diameter attacks to spy on targets

This newsletter is brought to you by application allow-listing software maker Airlock Digital. You can subscribe to an audio version of this newsletter as a podcast by searching for "Risky Business" in your podcatcher or subscribing via this RSS feed. You can also add the Risky Business newsletter as a Preferred Source to your Google search results by going here.

A newly discovered Chinese cyber-espionage group is hacking telcos across Asia to exploit the SS7 and Diameter protocols and spy on carefully selected targets.

The new SilentAir group has been active for at least two years, since early 2025, according to telco security firm ENEA, which has been tracking its operations.

The group is hacking telco infrastructure and planting backdoors that run malicious SS7 and Diameter commands designed to collect device data, track a subscriber's location, and even intercept calls and SMS traffic.

ENEA researchers say the group is clearly a highly-sophisticated threat actor specialized in covert espionage activity only. The group has targeted a handful of individuals despite the broad access it had.

While SilentAir SS7/Diameter attacks have been discovered across telcos in six countries, most of the targets have been Taiwanese telcos and their subscribers.

In some very rare instances, the group also went after high-value VIP individuals, such as political figures and government officials.

SilentAir is the second known APT group after Russia's HiddenArt to exploit telephony signalling protocols. According to ENEA, SilentAir ran a more stable operation compared to HiddenArt because of the foothold it had in the hacked networks through its malware.

The company also noted an intersection between telcos hit by Liminal Panda, another Chinese APT specialized in telco hacking, and SilentAir. Sometimes, the two Chinese groups were on the same telco networks at the same time, however, only SilentAir was observed using SS7 and Diameter to spy on subscribers. So far, any official cooperation between the two could not be confirmed.

Risky Business Podcasts

The main Risky Business podcast is now on YouTube with video versions of our recent episodes. Below is our latest weekly show with Pat, Adam, and James at the helm!

Breaches, hacks, and security incidents

US village loses $26m in email scam: A New Jersey historic village has lost $26 million in an email scam. According to the Wall Street Journal, township staff got tricked into wiring money to the wrong account for a land purchase. The incident took place in September but was only revealed three days after a township committee election. [WSJ]

Hackers hit South Korea's financial security agency: Hackers have breached and stolen personal data from South Korea's financial security agency FSEC. The agency confirmed the hack in a press release on Tuesday. Ironically, the hackers hit a website where financial institutions submit security assessments. [FSEC // Seoul Economic Daily]

Brazil's largest port hit by cyberattack: A cyberattack has crippled the IT network at Brazil's largest port. The Port of Santos in Sao Paolo has been operating on manual procedures for the past five days. According to local media, the attack began with a power outage after hackers accessed equipment left exposed online and then expanded from there. The port authority has since restored some systems, such as internet and telephone connectivity. The same port authority was also hit by the n0n data extortion group in October, but refused to pay a $26 million ransom demand. [A Tribuna // World Ports // Ransomware Live]

ConnectWise MSP hacks: A threat actor is compromising cloud-hosted ScreenConnect panels to install rogue agents on connected endpoints. According to security firm Huntress, the attacker has compromised at least six managed service providers (MSPs). It then pivoted to 288 endpoints at 48 organizations. ConnectWise says the hackers entered customer environments via a third-party extension named RMM+. The company has disabled the extension across 400 customer networks, including ones that were not yet exploited. [Huntress // Huntress on Reddit // ConnectWise // Sophos]

AllUnited breach: AllUnited, an app for managing sports clubs and communities, has reported a security incident, including the theft of customer data. More than 350 sports clubs are believed to have been affected. [AllUnited]

Taiwan passport scans stolen: Hackers have stolen more than 72,000 passport scans from Taiwan's Ministry of Foreign Affairs. The hack took place earlier this month, on November 4. [Taiwan News]

Grok had a leak: Grok's app building pipeline had leaked data from more than 35,000 apps after it failed to protect the app's build URL, allowing anyone to access them. [Claroc]

Baker Tilly discloses breach: One of the world's largest accounting firms is notifying customers of a security breach. Baker Tilly says hackers breached a third-party platform in September and stole customer data.  The company is the ninth accounting firm in the world by revenue. [California OAG]

Apify reports breach: AI tools marketplace Apify has notified customers of a security breach. The company says hackers accessed customer accounts in an incident earlier this week. Apify has revoked some OAuth connections, which it suspects were used to gain access to the accounts. It has also rotated some of its internal secrets as a precaution. [Apify]

Railway.com to cover costs for some hacked customers: Hackers abused credentials and tokens stolen from Railway.com customers last month to incur around $740,000 in unauthorized AI usage. Railway.com says it's working with AI providers to refund the unauthorized costs or even cover it itself. In a post-mortem report, Railway says hackers stole and decrypted customer environment variables from about 100,000 customers, or around 1.85% of its total customer base. [Railway]

Unocoin goes dark after accounts show $0 balance: India's oldest cryptocurrency exchange has suspended operations after a cyberattack last week. Unocoin pulled its platform offline after security firms noticed that more than 81,000 addresses associated with the platform began showing a $0 balance last Friday. Almost a week after the hack, Unocoin has yet to reveal how much money was stolen. [Unocoin // Crypto News]

n0n group takes credit for Qubole hack: The n0n data extortion group has taken credit for breaching the Qubole data lake platform. The group claims it stole almost 1PB of data from all Qubole customers over a months-long intrusion. n0n says it approached the company in private but it declined to negotiate.

General tech and privacy

United Airlines blocks AI agents from flight reservations: American airlines company United has blocked AI agents from booking flights. The company cited cybersecurity and flight risks. United says AI agents can make unwanted purchases but can also accidentally collect and then expose sensitive account data. The airline says a human's presence is still needed during the flight reservation and check-in processes to confirm that bags don't contain dangerous substances. [United]

Anthropic blocks Chinese and Russian users: Anthropic has updated its terms of service and banned users from China and Russia from accessing its Claude AI service. Users from Iran, North Korea, Belarus, and Venezuela are also banned. The new bans entered into effect on November 12. [Anthropic]

NVIDIA CEO resigns: NVIDIA CEO Jensen Huang has resigned after reports of two extramarital affairs, including one with a Chinese spy. NVIDIA has appointed Colette Kress as interim CEO. She is the company's current Executive Vice President and Chief Financial Officer. [NVIDIA]

Post by @marasawr@mastodon.social

View on Mastodon

Salon shuts down: News site Salon is shutting down after 31 years and after failing to find a long-term business model that is sustainable and doesn't involve flooding the site with ads, scams, or literal propaganda. [Salon]

eMuhdra revokes 8 more certs: Indian certificate authority eMuhdra has revoked another eight intermediate certificates after it mishandled their private keys. The company previously revoked another eight certificates last month after they were generated using weak private keys that were mostly zeros apart from the last character. The company has since left the SSL certificate market. [Mozilla bug tracker]

Firefox deploys new anti-fingerprinting tech: Mozilla has deployed new Firefox tech to make its users look more like the same and reduce the efficiency of user fingerprinting scripts. [Mozilla]

Apple shuts down support forums: Apple is permanently shutting down its support community forums on November 20. The site has been already put in read-only this week. [9to5Mac]

Post by @nicolas17@treehouse.systems

View on Mastodon

Government, politics, and policy

Romania confirms Turla hack: Romania's intelligence service has confirmed that one government organization was hacked by Russian APT group Turla at the end of last year, as revealed in an ESET report. [SRI // ESET]

Cyberattack takes down Poland's government platform: Poland has temporarily suspended its ePUAP e-government portal after detecting a cyberattack this week. Minister of Digital Affairs Krzysztof Gawkowski said evidence suggests foreign adversaries are involved. Government IT teams are now working to investigate and restore the platform. [Minister of Digital Affairs // TVN24]

Poland launches bug bounty program: Poland's CERT has launched an official bug bounty platform for government networks. This took place several days before the above-listed hack. [Zaufana Trzecia Strona // Bug bounty program]

UK launches CyAS: The UK government has launched a new program to help critical infrastructure organizations test their cyber defenses. The new Cyber Adversary Simulation (CyAS) scheme connects organizations with trusted cybersecurity providers that can mimic realistic attacks. Five cybersecurity companies have already received the needed certification. [UK NCSC // CyAS trusted providers]

Russia's internet watchlist reaches 900 entries: The database of whitelisted websites allowed to work on the Russian internet in the case of an emergency or shutdown has reached 900 entries. [Interfax]

Sponsor section

In this Risky Business sponsor interview, Tom Uren talks to Airlock Digital’s CTO and CSO Peter Baussmann about how the Essential Eight is evolving into ASD’s Essentials framework.

Arrests, cybercrime, and threat intel

Europol takes down Gootloader, CastleRAT, and StealC: Europol has seized the servers of three malware operations known as Gootloader, CastleRAT, and StealC. More than 6.4 million user credentials were found on the seized servers. No arrests were reported. [Europol]

SMS blaster arrested in Hungary: Hungarian police have arrested a Chinese national for driving with an SMS blaster device in his car. The 27-year-old suspect was arrested in July after authorities tracked his device's signal from Budapest to the city of Pécs, near Hungary's southern border. Authorities say the suspect had sent SMS spam with traffic fines that lured victims to fake police portals that collected payment card details. [Hungarian Police // CommsRisk]

Stadia interview: Threat intelligence analyst g0njxa has published an interview with Plymouth the developer of the Stadia infostealer, an evolution of the old StealC. [g0njxa]

Storm-3350 targets Brazil: Microsoft has spotted a new group that's targeting the cloud environments of Brazilian companies. [Microsoft]

https://bsky.app/profile/threatintel.microsoft.com/post/3mzyjqbokos2p

GSocket abuse: Microsoft's security team has detected multiple intrusions where threat actors deployed GSocket (Global Socket), an open source remote access tool, on compromised Linux servers. [Microsoft]

wfx-loot campaign: A threat actor is pushing malicious workloads to GitHub repositories that steal secrets and cloud credentials from GitHub Actions. According to Aikido Security, the attacker is using more than 4,800 hacked GitHub accounts to push the workloads. Malicious payloads have been spotted on over 61,000 repositories. At least 1,800 had credentials and tokens stolen. [Aikido Security // SafeDep // Step Security]

Indie studio turns users into proxies: Indie game studio Appsalt is turning the users of its games and browser extensions into nodes in a larger proxy network. [Spur]

More SilverFox activity: Chinese e-crime group SilverFox is still evolving despite recent arrests and infrastructure takedowns. [VMRay]

ZoidWays: Confiant looks at ZoidWays, a mobile scareware redirection service that launched in March, this year. The service reached roughly 1.5 million blocked impressions in a single day and appeared across at least six ad-buying platforms. [Confiant]

Malware technical reports

Citrus ransomware: A new ransomware group named Citrus is targeting Russian companies, usually breaching their victims through contractors. [Kaspersky]

Wpcdoor targets DVRs: South Korean security researchers look at Wpcdoor, a new IoT malware strain planted on internet-connected DVR and CCTV devices. [AhnLab]

Hajime: Security researcher MalwareMustDie has published an analysis of the old Hajime botnet. [MalwareMustDie]

AntiFox AI framework: Threat actors are using a new AI agentic penetration testing framework named AntiFox to hack public cloud services. AntiFox is the work of a Chinese developer and was forked from the highly popular ARTEX AI framework. Security firm Arctic Wolf says the framework is currently being used to hack AWS environments. [Arctic Wolf]

Cairn AI framework: Chinese speaking threat actors abused a new AI framework named Cairn to breach tens of  systems, from government systems to semiconductor makers. [Palo Alto Networks]

Falcon (XG) framework: Researchers have spotted a new JavaScript framework that can run malicious code on user's browsers after luring targets on watering hole sites. [Palo Alto Networks]

"Operating entirely inside the browser context, attackers have used the framework to sideload malicious Chrome extensions and steal the following information: Passwords, Emails, Session cookies, Communications. Falcon also served as a delivery mechanism for an implant we call Antino, which uses Microsoft OneDrive as a C2 channel."

RevStealer: Security researchers have published an in-depth breakdown of the RevStealer infostealer, first spotted in the wild in Q3 2025. [Akatsuki Legion]

"REVSTEALER represents a significant evolution in the infostealer threat landscape. Its combination of industrial-scale distribution, advanced evasion techniques, and resilient command-and-control infrastructure demonstrates a mature, well-resourced threat actor. The malware's focus on gaming communities and users seeking free software exploits human psychology at scale, while its technical sophistication including VMProtect packing, indirect syscalls, API hashing, and blockchain dead drops presents substantial challenges for traditional security controls."

SANSAR cryptominer: Linux servers are being infected with a new and highly-sophisticated crypto-mining malware strain. Named SANSAR, the malware uses several never-before-seen techniques to stay undetected in compromised environments. SANSAR uses an NVIDIA library to falsify GPU activity readings and a rootkit to hide all its processes. It also uses a mixed Tor and Ethereum-based command and control system to prevent easy detection and takedowns. [Elastic]

Sponsor section

In this product demo of the Airlock Digital application control and allowlisting solution, Patrick Gray speaks with Airlock Digital co-founders David Cottingham and Daniel Schell. 

APTs, cyber-espionage, and info-ops

Kazakh hackers hit neighboring countries: Kazakhstan state-sponsored hackers have stolen thousands of defence-related government documents from neighboring Tajikistan. The Silent Lynx APT used DeepSeek models and the Hermes AI framework to automate the intrusion. Security firm CloudSEK discovered the hacks after Silent Lynx operators left a folder misconfigured online. The same folder contained evidence of similar campaigns targeting Tajikistan's railway network and Uzbekistan's Smart Forestry platform. [CloudSEK // Reuters]

Void Blizzard/Laundry Bear members doxxed: Security researchers have doxxed two members of a FSB-aligned APT group known as Void Blizzard (or Laundry Bear). The two—Anton Listarov and Vyacheslav Zubkov—worked for a private Russian company named IAC EMERCOM and later at Yutek-NN. They worked on hacking campaigns targeting Russian opposition activists, such as Alexei Navalny. They got their orders from an FSB officer named Denis Obrezko, who was arrested in Thailand and extradited to the US this year. [Malfors]

"The evidence indicates with high confidence that Anton Listarov controlled accounts and infrastructure used in the 2021 email campaigns targeting Russian opposition supporters. We assess with moderate confidence that Vyacheslav Zubkov supported related data-processing and operational activity and coordinated with Listarov."

DPRK's Trigram campaign: A new DPRK "fake job interview" is underway, targeting the AI, blockchain, and logistics sectors across Europe and the United States. [Stormshield]

DarkLunnen: Group-IB has found a new APT group named DarkLunnen. According to evidence found in an open directory, the group has targeted orgs in Ukraine, Poland, and other European countries. [Group-IB]

Vulnerabilities, security research, and bug bounty

Security updates: Apache HTTP, Gerrit, MongoDB, N-able, Node.js, React.

More exploitation: CISA has reported active exploitation of a Cisco BroadWorks bug from August, and an Openwave AI bug from October. [CISA]

Hackers target Check Point devices with PHP2Shell: A threat actor is exploiting the PHP2Shell vulnerability to take over Check Point security gateways. Initial attacks began on October 30 and targeted Israeli orgs with destructive attacks. A second wave followed days later targeting more countries with webshells and backdoors. Check Point is the second security firm after Palo Alto Networks to have its devices exploited using PHP2Shell. [Check Point]

More Danfoss refrigerator bugs: Midnight Blue security researcher Carlo Meijer has found five pre-auth RCE vulnerabilities in the Danfoss SM-800A refrigerator management system. Danfoss is one of the vendors that were targeted in the recent wave of refrigerator hacks across Europe over the past month. Meijer found the bugs in less than an hour of code manual inspection. The vulnerabilities can lead to full device takeover or can be used to brick the device. The bugs have been reported to the vendor, but no patches are available yet. [Midnight Blue // Sekoia]

SignDrop zero-day: Security researcher Nightmare Eclipse has released a new Windows zero-day named SignDrop. The zero-day can allow attackers to elevate privileges on Windows systems. It works by exploiting Microsoft's mitigations against CLFS authentication attacks. The researcher published the exploit shortly after Microsoft released this month's Patch Tuesday security updates.[Nightmare Eclipse // Cyderes]

Apache patches major RCE: The Apache Software Foundation has patched a remote code execution bug in its popular HTTP web server project. Tracked as CVE-2026-119618, the vulnerability allows remote unauthenticated attackers to run malicious code on the server via HTTP/2 connections. According to Wiz, 64% of cloud environments run vulnerable Apache server versions. [Apache HTTP CVE-2026-119618 // Wiz // Wordfence // Praetorian]

Telegram fixes Android app RCE: Telegram has rolled out a security update for its Android app this week to fix a remote code execution bug that can be exploited via its (rich HTML) widgets feature. [Telegram]

OpenAI patches CI/CD hijack: OpenAI has patched a vulnerability that could have allowed an attacker to gain control over the publishing pipeline for OpenAI's official Codex npm package. [Depi Security]

AI finds 99 critical infrastructure bugs: Forescout researchers say they found 99 vulnerabilities in critical infrastructure systems using "generally available AI models on a limited budget." All took just 90 hours. [Forescout]

Glasswing is mid: Only 442 of the nearly 38,000 vulnerabilities found using Anthropic's Project Glasswing have received a CVE identifier, and only two of those have been exploited in the wild. According to security firm VulnCheck, more than 80% of the Glasswing findings have not been made public even months after the project launched. In the case bug reports became public, the project overwhelmed open source maintainers with duplicates or unvalidated work. [VulnCheck]

"AI is a valuable tool for finding vulnerabilities, and I'm not discounting that. But seven months in, the evidence still doesn't match the launch narrative. The CVEs are a sliver of this year's total, almost none are being exploited, fixes have stalled while duplicates and withdrawals pile up, and the triage burden is shifting onto the open source maintainers Glasswing promised to help. The receipts keep coming in. They still don't reconcile."

Infosec industry

Threat/trend reports: Check Point, CyFirma, ENISA, Kaspersky, and Redsec Labs have recently published reports and summaries covering various emerging threats and industry trends.

New tool—Modern Web Guidance: Google has released a set of skills that embed web platform expertise, best practices, and browser compatibility data directly into your AI coding agents.

New tool—ExploitTotal: Anyday Security has launched ExploitTotal, a tool to analyze patches and generate exploit code for disclosed vulnerabilities.

New tool—ProtoSpector: Security firm Doyensec has open-sourced ProtoSpector, a Burp Suite extension for analyzing, tampering with, and testing Protobuf and gRPC traffic.

Risky Business podcasts

In this edition of Seriously Risky Business, Tom Uren and Amberleigh Jack talk about the French government attributing freezer hacks to cyber units within the Iranian Revolutionary Guard Corp. This surprises Tom, because the hacks were entirely consistent with Russian sabotage operations across Europe.