China attacked more than 600 companies in 80 countries around the world
China attacked more than 600 companies in 80 countries around the world#### magine that hackers have been sitting in your network for three years and you don’t know about it. That’s exactly what happened to hundreds of companies around the world. The Chinese APT group Salt Typhoon carried out one of the most extensive cyber campaigns in history.
A Chinese APT group known as Salt Typhoon has just carried out one of the most extensive and sophisticated cyber campaigns in history. Active since at least 2019, the campaign began with attacks on telecommunications infrastructure and subsequently expanded its reach to government institutions, transportation, and military systems around the world.
The group has attacked more than 600 organizations worldwide, with over 200 entities affected in the US alone. Specific victims include Verizon, AT&T, and T-Mobile.
Salt Typhoon’s technical methods are not particularly sophisticated. The group does not focus on zero-day exploits, but exploits known, often unpatched vulnerabilities in network devices from major manufacturers. It primarily targets CVE-2018–0171, CVE-2023–20198, and CVE-2023–20273 in Cisco devices, CVE-2023–46805 and CVE-2024–21887 in Ivanti products, and CVE-2024–3400 in Palo Alto Networks systems. Cisco Talos has revealed that hackers often gain initial access using legitimate credentials rather than exploits and are able to maintain access to the target environment for more than three years. They use advanced malware, including the GhostSpider backdoor and Demodex rootkit, to maintain persistence.
- August 2025, a coalition of 13 countries, including the Czech Republic, issued a joint security bulletin. This coordinated response represents one of the most extensive international responses to a cyber campaign in history.
“It is essential that organizations in targeted critical sectors pay attention to this international warning about the threat posed by cyber actors exploiting publicly known — and therefore fixable — vulnerabilities.”
PromptLock: The First AI-Powered Ransomware
ESET recently uncovered a revolutionary ransomware called PromptLock. It is the first ransomware to use artificial intelligence to generate malicious code in real time.
PromptLock is programmed in Golang and uses OpenAI’s gpt-oss:20b model via the local Ollama API. This open-weight language model was only released by OpenAI at the beginning of August 2025, and we are already facing AI-powered ransomware.
A unique feature of PromptLock is its ability to generate customized ransomware notes based on the type of infrastructure attacked — whether it’s a personal computer, a corporate server, or even SCADA systems.
ESET warns that the variability provided by ransomware poses new challenges for detection. If implemented correctly, detection could become very complicated.
An interesting technical aspect is that PromptLock does not download the entire model (which would be several GB), but the attacker can simply create a proxy or tunnel from the compromised network to a server with the Ollama API and gpt-oss-20b model.
Zero-click exploit threatens WhatsApp
WhatsApp recently released an emergency security update due to the discovery of a critical vulnerability, CVE-2025–55177, which was actively exploited in sophisticated spyware campaigns. This vulnerability, with a CVSS score of 8.0, affects WhatsApp for iOS and macOS and relates to insufficient authorization of synchronization messages between linked devices. The issue was discovered by internal researchers on the WhatsApp security team.
The most serious aspect of this vulnerability is its combination with Apple vulnerability CVE-2025–43300. The Apple vulnerability involves an “out-of-bounds write” bug in the ImageIO framework that can cause memory corruption when processing a malicious image. When both vulnerabilities are combined, they create a “zero-click” exploit chain — an attack that requires no interaction from the victim.
This incident is not isolated — in March 2025, WhatsApp addressed another zero-day vulnerability that was exploited to deliver Graphite spyware from Paragon. Similar to the current campaign, journalists and activists were the primary targets at that time.
WhatsApp recommends that affected users perform a full factory reset of their device and keep both the operating system and the application up to date. The reason for the drastic measure of a factory reset is that even though WhatsApp has fixed its part of the exploit, the device’s operating system may remain compromised by malware.
Attack on Salesforce
The newly identified UNC6395 group compromised OAuth and refresh tokens of the chat agent Drift, gaining API access to Salesforce tenants of more than 700 companies. In just ten days, the attackers ran structured SOQL queries on Cases, Accounts, Users, and Opportunities objects, systematically exported data, and deleted jobs to make forensic analysis more difficult.
A key factor in their success was the long-term validity and high permissions of the tokens that Drift issued when integrating with Salesforce and Google Workspace. When a token falls into the wrong hands, it becomes a universal ticket to the SaaS environment — without the need to break MFA or the company VPN.
The vendors’ response was swift, but it also revealed weaknesses in standard operating procedures. On August 20, Salesforce and Salesloft collectively invalidated the tokens and removed Drift from AppExchange. Google subsequently deactivated all Drift Email integrations. However, administrators were left with the difficult task of going through all the logs and searching for anomalies.