GoKawiil
Tech News
Proofpoint researcher Selena Larson told Dark Reading that threat actors like TA4903 and TA2725, once sophisticated operations, have grown less effective after adopting AI tools in their attack chains. She contrasted this with widely cited survey data claiming 84% of ransomware attacks now involve AI, arguing that such headline figures overstate AI's actual impact on attacker capability.
Proofpoint researchers reported that China-linked group TA419 ran a July phishing campaign impersonating US officials, including a former White House science and technology policy staffer, to steal credentials from AI experts at US think tanks, universities, defense contractors and law firms. The campaign followed similar activity in February, when the group posed as an Anthropic employee to target a think tank AI policy expert, and is part of a pattern Proofpoint says dates back to at least April 2025.
Cybersecurity firm Proofpoint reported that a suspected China-aligned hacking group, tracked as TA419, impersonated Anthropic employees and a former White House official to approach AI policy experts at think tanks, universities and law firms. The attackers used fake invitations to join an AI policy advisory group or contribute to a fictitious Senate report, then sent malware-laced documents aimed at compromising victims' cloud accounts. One email impersonating a senior Anthropic staffer referenced 'military integration of Claude' to lure a think-tank target.
Proofpoint researchers presented findings at Protect 2026 describing a threat actor, tracked as UNK_CondorFiltration, that has been targeting Microsoft 365 environments in Chile since July 21. Using the open-source TeamFiltration toolkit and credential spraying, the attacker did not compromise any human employee accounts but instead broke in through neglected non-human machine and service accounts, gaining access to sensitive data.
Security researchers at Proofpoint and Volexity uncovered a modular attack tool called BlueMoon that strings together two Chromium browser flaws and a Windows kernel bug to achieve remote code execution and system-level control. The kit has been used since late August by China-linked group JungleBamboo (also known as APT31) and by a separate actor Volexity calls UTA0560, which targeted NGO staff. Analysts believe one of the three vulnerabilities, a Windows ALPC flaw, was repurposed from an existing 2025 exploit rather than newly built.
Proofpoint identified an exploit toolkit, dubbed BlueMoon, that chains two Chromium vulnerabilities with a Windows kernel flaw to deploy malware on victims' machines. At least four separate hacking groups, some linked to the Chinese government, have deployed the kit within days of each other, and all three underlying vulnerabilities have only just received patches.
Proofpoint, owned by private equity firm Thoma Bravo, is reportedly in advanced negotiations to acquire cybersecurity company Varonis Systems. News of the talks sent Varonis shares sharply higher, reflecting its roughly $5 billion market valuation.