Daily Briefing for 07.18.25

At a glance.

• UK sanctions Russian military intelligence officers for cyber reconnaissance operations.
• China's Salt Typhoon breached a US state's National Guard network.
• Google sues BadBox 2.0 botnet operators.

UK sanctions Russian military intelligence officers for cyber reconnaissance operations.

The British government has sanctioned eighteen Russian military intelligence officers belonging to three GRU units for allegedly conducting cyber reconnaissance that led to hundreds of murders and civilian deaths in Ukraine, the Record reports. One of the sanctioned GRU units allegedly helped to target a missile strike that killed hundreds of civilians in the Mariupol Theatre in 2022. Another is accused of surveilling Yulia and Sergei Skripal before their attempted murders with the Novichok nerve agent in the UK.

The UK's National Cyber Security Centre (NCSC) has also published a technical analysis of a newly observed strain of malware deployed by the GRU threat actor APT28.

China's Salt Typhoon breached a US state's National Guard network.

The Chinese threat actor Salt Typhoon "extensively compromised" a US state's National Guard network last year and "collected its network configuration and its data traffic with its counterparts' networks in every other US state and at least four US territories," according to a US Department of Homeland Security memo obtained by NBC News. The threat actor was present on the network for nine months between March and December 2024. BleepingComputer further quotes the memo as saying, "This data also included these networks' administrator credentials and network diagrams—which could be used to facilitate follow-on Salt Typhoon hacks of these units."

A National Guard Bureau (NGB) spokesperson confirmed the compromise, telling NBC that the attack "has not prevented the National Guard from accomplishing assigned state or federal missions, and that NGB continues to investigate the intrusion to determine its full scope."

Google sues BadBox 2.0 botnet operators.

Google has filed a lawsuit against 25 unnamed individuals in China for allegedly operating the BadBox 2.0 botnet, which has compromised "over 10 million uncertified devices running Android’s open-source software." Google notes, "Cybercriminals infected these devices with pre-installed malware and exploited them to conduct large-scale ad fraud and other digital crimes."

The company said in its lawsuit, "Because of the size and scope of the BadBox 2.0 Scheme, cybersecurity experts have alerted the public, and Google is seeking an injunction to disrupt its infrastructure and stop its spread. Google brings this action under the Computer Fraud and Abuse Act (“CFAA”) and Racketeer Influenced and Corrupt Organizations Act (“RICO”) against Defendants’ criminal enterprise to disrupt the BadBox 2.0 Scheme, to prevent it from causing further harm, and to recover damages."