At a glance.
- Salt Typhoon breached a Canadian telecom.
- Steel giant Nucor says data was stolen during last month's attack.
- APT28 distributes new malware via Signal phishing attacks.
Salt Typhoon breached a Canadian telecom.
The Canadian Centre for Cyber Security and the US FBI have released a bulletin warning that the Chinese state-sponsored threat actor Salt Typhoon is targeting Canadian telecoms, breaching at least one entity earlier this year. The bulletin states, "Three network devices registered to a Canadian telecommunications company were compromised by likely Salt Typhoon actors in mid-February 2025. The actors exploited CVE-2023-20198 to retrieve the running configuration files from all three devices and modified at least one of the files to configure a GRE tunnel, enabling traffic collection from the network."
The bulletin adds, "[W]e assess that PRC cyber actors will almost certainly continue to target Canadian organizations as part of this espionage campaign, including telecommunications service providers and their clients, over the next two years."
Steel giant Nucor says data was stolen during last month's attack.
US steel giant Nucor has disclosed that hackers stole "limited data" from the company's IT systems during a cyberattack last month, SecurityWeek reports. The company says it's "reviewing and evaluating the impacted data and will carry out any appropriate notifications to potentially affected parties and to regulatory agencies as required by applicable law." The company added that the incident is not expected to have a material impact on its financial condition.
The company hasn't shared details on the nature of the attack, though SecurityWeek notes that the response suggests ransomware may have been involved.
APT28 distributes new malware via Signal phishing attacks.
Russia's APT28 is targeting Ukrainian government entities via phishing attacks on Signal, BleepingComputer reports. The attacks distribute malicious documents that install two newly observed strains of malware dubbed "BeardShell" and "SlimAgent." BeardShell is designed to download PowerShell scripts, while SlimAgent captures screenshots of infected computers.
BleepingComputer notes that the attacks don't involve any vulnerabilities in Signal, but "threat actors are more commonly utilizing the messaging platform as part of their phishing attacks due to its increased usage by governments worldwide."
