# Cyber-espionage Published articles for Cyber-espionage. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## North Korean hackers target Rust maintainers through fake job interviews DevFeed: [North Korean hackers target Rust maintainers through fake job interviews]() Original publisher: [Read original article]() Author: Zeljka Zorz Published: 2026-09-21T12:27:05Z Content type: news Language: en Sources: [Help Net Security]() Topics: [Security](), [Rust](), [Maintainers](), [Malware](), [Job]() Tags: [account-hijacking](), [cryptocurrency](), [cyber-espionage](), [developer](), [don-t-miss](), [enterprise](), [government-backed-attacks](), [hot-stuff](), [job](), [maintainers](), [malware](), [news](), [north-korea](), [remote-working](), [requirements](), [rust](), [scam](), [scams](), [security](), [social-engineering](), [software-development](), [tips]() ### AI overview The article reports that North Korean attackers are targeting Rust developers and package maintainers with fake job, contract, and collaboration opportunities. Victims are pressured to install software or run attacker-supplied commands, potentially enabling malware publication and account compromise. ### Source excerpt Attackers are targeting members of the Rust Project and maintainers of widely used crates (Rust code libraries), dangling attractive opportunities to compromise their devices and accounts and, ultimately, publish malware. The warning came last week from the Rust Project's crates.io team and security response working group, and described a recurring pattern: a target is invited to a video call framed as a job, contract, or collaboration opportunity, then nudged into installing something or running an ... More -> The post North Korea's job interview scam runs both ways appeared first on Help Net Security. ## OpenAI's cyber defense letter gets the diagnosis right and the prescription wrong DevFeed: [OpenAI's cyber defense letter gets the diagnosis right and the prescription wrong]() Original publisher: [Read original article]() Author: Brad LaPorte Published: 2026-09-21T09:00:00Z Content type: opinion Language: en Sources: [InfoWorld]() Topics: [Security](), [OpenAI](), [Threat Research](), [Vulnerabilities](), [Endpoint Security & XDR](), [Claude Code](), [anthropic](), [amazon](), [Google](), [Microsoft]() Tags: [amazon](), [anthropic](), [artificial-intelligence](), [artificial-intelligence-cyberattacks-cybercrime-data-and-information-security-generative-ai-sec](), [claude-code](), [cyber-espionage](), [cyberattacks](), [cybercrime](), [data-and-information-security](), [generative-ai](), [google](), [microsoft](), [openai](), [security](), [threat-intelligence](), [vulnerabilities]() ### AI overview An opinion article argues that OpenAI's cyber defense letter correctly identifies the growing sophistication of AI-enabled cyberattacks but offers recommendations that are too reactive and slow. It contrasts those measures with an Anthropic account of an AI-orchestrated espionage campaign involving Claude Code and argues that defenders must close response-time gaps. ### Source excerpt On August 27, 2026, OpenAI published an open letter titled "A call for collective action on cyber defense." More than 100 organizations signed it (CNBC counted 116) including Anthropic, Microsoft, Google, Amazon, CrowdStrike, Palo Alto Networks, Mastercard, and Visa. The central message is blunt: In the coming months, AI-enabled cyberattacks will become far more widespread and sophisticated as models around the world become increasingly capable. They're right, and the letter is more honest than most industry documents of its kind. It concedes that current security practices are not sufficient. It names hospitals, water treatment plants, and power systems instead of hiding behind the word critical. It admits that the technical debt is real and that the teams are under-resourced. Then it reaches the recommendations, and the urgency drains out of the room. The asks describe a world where you still get to react The letter's four calls to action come down to threat intelligence sharing, coordination across levels of government, funding for under-resourced essential services, patching high-risk vulnerabilities, and giving defenders access to capable models during an incident. All of it is worth doing. All of it also happens either long before an attack, on a timeline you control, or after an attack has already started. Intelligence sharing assumes somebody saw it first. Coordination assumes there's time to convene. Funding assumes a budget cycle. Patching assumes a published CVE and a maintenance window you can actually get approved. That is a defense architecture built for an adversary who works business hours. Run the arithmetic on GTG-1002 On November 14, 2025, Anthropic disclosed what it called the first reported AI-orchestrated cyber espionage campaign. A Chinese state-linked group it tracks as GTG-1002 hit roughly 30 organizations and used Claude Code to execute 80% to 90% of the operation independently. Human operators contributed a maximum of about 20 minutes of w ## Chinese hackers use SparroWocky malware in govt espionage attacks DevFeed: [Chinese hackers use SparroWocky malware in govt espionage attacks]() Original publisher: [Read original article]() Author: Bill Toulas Published: 2026-09-17T09:00:00Z Content type: news Language: en Sources: [BleepingComputer]() Topics: [ransomware](), [backdoor](), [Security](), [C++](), [Windows](), [Persistence](), [Open Source](), [Process](), [Network]() Tags: [attacks](), [backdoor](), [c-plus-plus](), [china](), [computer-help](), [computer-security](), [computers](), [cyber-espionage](), [famoussparrow](), [government](), [infosec](), [infosec-computer-security](), [linux](), [mac](), [malware](), [malware-removal](), [network](), [open-source](), [persistence](), [process](), [processes](), [security](), [sparrowocky](), [spyware](), [support](), [tech-support](), [technical-support](), [virus](), [virus-removal](), [windows]() ### AI overview ESET researchers identified SparroWocky, a modular C++ backdoor used by the China-linked FamousSparrow espionage group against government organizations across Latin America. The malware supports command execution, data collection, file operations, screenshots, TCP proxying, and persistence while using multiple evasion techniques. ### Source excerpt The China-linked espionage group FamousSparrow has been using a new backdoor named SparroWocky in attacks on government organizations in Latin America. [...] ## US officials revise claims that government agencies were hacked by Chinese, now say they were targets DevFeed: [US officials revise claims that government agencies were hacked by Chinese, now say they were targets]() Original publisher: [Read original article]() Author: Reuters Published: 2026-08-31T01:01:37Z Content type: news Language: en Sources: [Technology | The Indian Express]() Topics: [Cybersecurity](), [Hacking](), [Threat Research](), [national security](), [cybersecurity and infrastructure security agency]() Tags: [chinese-state-cyber-attacks-us-senate-nasa](), [cyber-espionage](), [cybersecurity](), [department-of-justice](), [doj-revises-china-hack-statement](), [espionage](), [fbi-chinese-cyber-espionage-campaign](), [government](), [hacking](), [nanjing-xinjiuwei-network-technology](), [nasa](), [patching](), [qscan-qtrouter-domain-seizure](), [qtfy-chinese-state-sponsored-hackers](), [tech](), [technology](), [technology-tech](), [us](), [us-agencies-targeted-not-compromised]() ### AI overview U.S. officials corrected earlier claims that several government agencies had been hacked by a Chinese state-sponsored group, clarifying that the agencies were targets and that only some were compromised. The correction narrows the scope of confirmed breaches in a broader cyber-espionage campaign. ### Source excerpt The distinction matters because it narrows the scope of confirmed breaches in what the DOJ described as a years-long Chinese cyber-espionage campaign against U.S. government agencies, defense contractors and other sensitive targets. ## Armored Likho expands its cyber-espionage toolkit DevFeed: [Armored Likho expands its cyber-espionage toolkit]() Original publisher: [Read original article]() Author: Konstantin Isakov Published: 2026-08-13T08:00:15Z Content type: article Language: en Sources: [Securelist]() Topics: [infection chain](), [C2](), [API](), [kaspersky](), [Rust](), [Tauri](), [App](), [Framework](), [data](), [Server]() Tags: [api](), [app](), [apt](), [apt-reports](), [armored-likho](), [audio-surveillance](), [command-and-control](), [cyber](), [cyber-espionage](), [dropper](), [eavesdropping](), [espionage](), [files](), [framework](), [full](), [great-research](), [infection-chain](), [kaspersky](), [large](), [logs](), [malware](), [malware-descriptions](), [malware-technologies](), [medium](), [rust](), [spyware](), [still-toolkit](), [targeted-attacks](), [tauri](), [telegram](), [thumbnail](), [trojan](), [trojan-stealer]() ### AI overview Kaspersky researchers describe an Armored Likho cyber-espionage campaign that uses a fake donation app to deliver the Rust-based Still Toolkit. Its components steal Telegram session data and conduct covert audio surveillance. ### Source excerpt Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.