nltimes.nl/ Thursday, 28 August 2025 - 12:50 -
Dutch intelligence agencies confirmed on Thursday that the country was targeted in the global cyberespionage campaign carried out by the Chinese state-linked hacker group Salt Typhoon. The campaign, which came to light in late 2024, focused on the international telecommunications sector.

The Dutch Military Intelligence and Security Service (MIVD) and the General Intelligence and Security Service (AIVD) said they independently verified portions of a U.S. investigation attributing the campaign to Salt Typhoon. “We can confirm parts of the U.S. findings through our own intelligence,” the agencies stated.

The warning aligns with alerts issued by the U.S. National Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Federal Bureau of Investigation (FBI), as well as European intelligence services including Germany’s BND, Finland’s SUPO, the U.K.’s NCSC, and Italy’s AISE.

In the Netherlands, the targets were smaller Internet service and hosting providers rather than the major telecom operators. Investigations by the MIVD and AIVD indicate that the hackers gained access to routers of Dutch targets but, as far as is known, did not penetrate internal networks further. Where possible, the agencies and the National Cyber Security Centre (NCSC) shared threat information with affected organizations.

The agencies emphasized that China’s cyber activities have become increasingly sophisticated. “These activities are now so advanced that continuous effort and attention are needed to detect and counter cyber operations against Dutch interests,” the MIVD and AIVD said. They added that while proactive measures can reduce risk, complete prevention is not possible, posing a significant challenge to national cyber resilience

Threat actors in the cyberespionage ecosystem are using ransomware for financial gain, disruption, distraction, misattribution, and the removal of evidence.

Sophos Managed Detection and Response initiated a threat hunt across all customers after the detection of abuse of a vulnerable legitimate VMware executable (vmnat.exe) to perform dynamic link library (DLL) side-loading on one customer’s network. In a search for similar incidents in telemetry, MDR ultimately uncovered a complex, persistent cyberespionage campaign targeting a high-profile government organization in Southeast Asia. As described in the first part of this report, we identified at least three distinct clusters of intrusion activity present in the organization’s network from at least March 2023 through December 2023.

The three security threat activity clusters—which we designated as Alpha (STAC1248), Bravo (STAC1870), and Charlie (STAC1305) – are assessed with high confidence to operate on behalf of Chinese state interests. In this continuation of our report, we will provide deeper technical analysis of the three activity clusters, including the tactics, techniques, and procedures (TTPs) used in the campaign, aligned to activity clusters where possible. We also provide additional technical details on prior compromises within the same organization that appear to be connected to the campaign.

MoustachedBouncer is a cyberespionage group discovered by ESET Research and first publicly disclosed in this blogpost. The group has been active since at least 2014 and only targets foreign embassies in Belarus. Since 2020, MoustachedBouncer has most likely been able to perform adversary-in-the-middle (AitM) attacks at the ISP level, within Belarus, in order to compromise its targets. The group uses two separate toolsets that we have named NightClub and Disco.

“Russia used sophisticated malware to steal sensitive information from our allies, laundering it through a network of infected computers in the United States in a cynical attempt to conceal their crimes.  Meeting the challenge of cyberespionage requires creativity and a willingness to use all lawful means to protect our nation and our allies,” stated United States Attorney Peace.  “The court-authorized remote search and remediation announced today demonstrates my Office and our partners’ commitment to using all of the tools at our disposal to protect the American people.”

A U.S. and Greek national who worked on Meta’s security and trust team while based in Greece was placed under a yearlong wiretap by the Greek national intelligence service and hacked with a powerful cyberespionage tool, according to documents obtained by The New York Times and officials with knowledge of the case.

The government of Ukraine is asking for volunteers from the country's hacker underground to help protect critical infrastructure and conduct cyber spying missions against Russian troops, according two people involved in the project.

Twitter Inc. told a U.S. senator it is cutting ties with a European technology company that helped it send sensitive passcodes to its users via text message. The social media firm said in a disclosure to U.S. Senator Ron Wyden, a Democrat from Oregon, that it is “transitioning” its service away from working with Mitto AG, according to a Wyden aide.

Analyzing OSX.DazzleSpy
A fully-featured cyber-espionage macOS implant