PeckBirdy framework used by China-linked APTs targets gambling and government entities

SCM feed for Latest

January 28, 2026 at 6:58 PM

Actively Exploited

Overview

A new cyber threat known as the PeckBirdy framework has been linked to advanced persistent threats (APTs) associated with China. This framework is particularly targeting gambling and government entities, utilizing JScript and living-off-the-land binaries (LOLBins) to execute attacks across various environments. The implications of these attacks are significant, as they could compromise sensitive information and disrupt operations within the affected sectors. Organizations in the gambling and government sectors should be vigilant and strengthen their security measures to prevent potential breaches. Researchers are continuing to monitor the situation for further developments and potential mitigation strategies.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Gambling and government entities
Action Required: Organizations should enhance security protocols and monitor for unusual activity.
Timeline: Newly disclosed

Original Article Summary

PeckBirdy leverages JScript and living-off-the-land binaries (LOLBins) to execute across various environments.

Impact

Gambling and government entities

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance security protocols and monitor for unusual activity. Specific patches or updates were not mentioned.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to APT.

Read Original Article

Related Coverage

Critical n8n flaws disclosed along with public exploits

BleepingComputer

Researchers have identified multiple serious vulnerabilities in n8n, a widely used open-source workflow automation platform. These flaws could enable attackers to escape the security measures of the software, potentially giving them complete control over the host server. This poses a significant risk to users, especially those running n8n in production environments. If exploited, these vulnerabilities could lead to unauthorized access and data breaches, impacting businesses that rely on n8n for automation tasks. Users are strongly advised to assess their systems and implement necessary security measures as soon as possible.

Feb 4, 2026

Taiwanese operator of Incognito Market sentenced to 30 years over $105M darknet drug ring

Security Affairs

Rui-Siang Lin, a 24-year-old Taiwanese man, has been sentenced to 30 years in prison for his role in operating Incognito Market, a significant darknet drug marketplace. This platform facilitated the sale of over one ton of illegal drugs, amounting to more than $105 million in transactions. Lin was found guilty of various charges, including conspiracy to distribute narcotics. The case illustrates the ongoing challenges law enforcement faces in combating illicit online drug trade and underscores the risks associated with the anonymity provided by darknet platforms. The long sentence reflects the severity of his actions and serves as a warning to others involved in similar activities.

Feb 4, 2026

Half of Chrome AI extensions are harvesting your data - see the surprising worst offenders

CISA: VMware ESXi flaw now exploited in ransomware attacks

BleepingComputer

CISA has reported that ransomware gangs are now exploiting a serious vulnerability in VMware ESXi, which allows attackers to escape sandboxes and gain unauthorized access to systems. This vulnerability, which had previously been used in zero-day attacks, poses a significant risk to organizations using affected VMware products. Companies relying on VMware ESXi for virtualization need to be particularly vigilant, as attackers are actively targeting this flaw. The exploitation of such vulnerabilities can lead to severe data breaches and financial losses. Organizations should prioritize patching their systems to mitigate this risk and protect sensitive data from potential ransomware attacks.

Feb 4, 2026

Global SystemBC Botnet Found Active Across 10,000 Infected Systems

Infosecurity Magazine

Researchers have identified the SystemBC malware, which is currently active across approximately 10,000 infected systems. This botnet is particularly concerning as it poses risks to sensitive government infrastructure, potentially exposing critical data and functionalities to malicious actors. The malware's widespread presence raises alarms about the security of various networks, especially those that manage important public services. Organizations, particularly in the public sector, need to take immediate action to secure their systems against this threat. Failure to address this could lead to significant operational disruptions and data breaches.

Feb 4, 2026

UK investigates X over Grok AI's nonconsensual image generation

SCM feed for Latest

The UK's data protection authority has initiated an investigation into X and its Irish subsidiary over allegations that the Grok AI assistant was utilized to create nonconsensual sexual images. This raises serious concerns about privacy and consent, particularly in how AI technologies are being employed. The investigation aims to determine whether X has violated data protection laws, especially regarding the generation of harmful content without individuals' consent. The implications of this investigation could lead to stricter regulations on AI use and accountability for companies developing such technologies. Users and stakeholders are closely watching this case, as it could set precedents for how AI-generated content is governed.

Feb 4, 2026