Officials warn about expansive, ongoing China espionage threat riding on Brickstorm malware

CyberScoop
Actively Exploited

Overview

The article highlights an ongoing espionage threat from China, utilizing Brickstorm malware that has affected numerous organizations over the past three years. The average duration of these attacks is reported to be 393 days, indicating a significant and persistent threat landscape.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Dozens of organizations (specific products or systems not specified)
  • Timeline: Ongoing since at least three years

Original Article Summary

The attacks, which have impacted dozens of organizations, date back at least three years, lasting an average of 393 days. And that’s just what’s been uncovered in the last four months. The post Officials warn about expansive, ongoing China espionage threat riding on Brickstorm malware appeared first on CyberScoop.

Impact

Dozens of organizations (specific products or systems not specified)

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since at least three years

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Related Coverage

FTC bans GM from selling drivers' location data for five years

BleepingComputer

The Federal Trade Commission (FTC) has reached an agreement with General Motors (GM) after charging the company with improperly collecting and selling the location and driving data of millions of drivers without their consent. This order prohibits GM from selling this data for five years, ensuring that drivers' privacy is better protected moving forward. The FTC's action underscores the importance of consumer consent in the collection of personal data, especially in an era where location tracking is prevalent in vehicles. The settlement aims to hold GM accountable for its practices and serves as a warning to other companies about the need to respect consumer privacy rights. Millions of drivers who use GM vehicles are affected by this decision, which seeks to restore trust in how their data is handled.

Jan 15, 2026

Lumen disrupts AISURU and Kimwolf botnet by blocking over 550 C2 servers

Security Affairs

Lumen's Black Lotus Labs has successfully disrupted a significant portion of the AISURU and Kimwolf botnet by blocking over 550 command-and-control (C2) servers. This botnet is notorious for facilitating DDoS attacks and proxy abuse, acting as a DDoS-for-hire service that has been used to target various organizations. By taking these C2 servers offline, Lumen aims to reduce the operational capabilities of this botnet, which has been a persistent problem for cybersecurity professionals. The disruption not only impacts the botnet operators but also helps protect potential victims from being targeted in future attacks. This action underscores the ongoing battle against cybercrime and highlights the importance of proactive measures in cybersecurity.

Jan 15, 2026

Palo Alto Networks warns of DoS bug letting hackers disable firewalls

BleepingComputer

Palo Alto Networks has released a patch for a serious vulnerability that could enable attackers to conduct denial-of-service (DoS) attacks, effectively disabling firewall protections. This flaw allows unauthenticated individuals to exploit the vulnerability, raising concerns for organizations relying on Palo Alto's security products. The ability to disable firewalls poses significant risks, as it could lead to unauthorized access and data breaches. Companies using affected products are urged to apply the patch immediately to safeguard their networks. This incident serves as a reminder of the ongoing challenges in maintaining cybersecurity defenses against evolving threats.

Jan 15, 2026

Palo Alto Fixes GlobalProtect DoS Flaw That Can Crash Firewalls Without Login

The Hacker News

Palo Alto Networks has addressed a serious vulnerability in its GlobalProtect Gateway and Portal software, identified as CVE-2026-0227, which carries a CVSS score of 7.7. This flaw allows for a denial-of-service (DoS) condition that can crash firewalls without requiring user authentication. A proof-of-concept exploit for this vulnerability is already available, raising concerns about its potential impact on organizations using these systems. Companies utilizing GlobalProtect PAN-OS software should promptly apply the security updates released by Palo Alto to safeguard their networks. Failure to address this vulnerability could leave systems open to disruptions, affecting overall network availability.

Jan 15, 2026

China bans U.S. and Israeli cybersecurity software over security concerns

Security Affairs

China has ordered domestic companies to cease using cybersecurity software from over a dozen U.S. and Israeli firms due to concerns about national security. This move comes amid escalating tensions between China and the U.S. regarding technology and trade, particularly in the semiconductor sector. The ban affects various cybersecurity solutions that many Chinese companies rely on to protect their networks and data. By restricting these foreign products, China aims to bolster its own cybersecurity infrastructure and reduce dependency on foreign technology. This decision could have significant implications for international cybersecurity firms and may lead to further divisions in the global tech landscape.

Jan 15, 2026

Microsoft disrupts massive RedVDS cybercrime virtual desktop service

BleepingComputer

Microsoft has successfully disrupted RedVDS, a significant cybercrime platform that has been linked to approximately $40 million in losses reported in the U.S. since March 2025. The platform was known for offering a virtual desktop service that criminals used to conduct various illegal activities. This disruption is a major step in combating cybercrime, as it not only targets the infrastructure used by attackers but also aims to deter future criminal operations. The impact of RedVDS has been felt widely, affecting numerous victims who have suffered financial losses due to the platform's activities. By taking action against RedVDS, Microsoft is contributing to a broader effort to enhance cybersecurity and protect individuals and businesses from ongoing threats.

Jan 15, 2026