Members of Russia's military forces have for several months been receiving "well crafted" phishing emails, and these are (apparently) the work of Chinese intelligence services. Discovered and disclosed by Proofpoint, the espionage campaign is directed at military capability and telecommunications systems. (Proofpoint says Russian-speaking financial analysts covering the telecom sectors have been collateral damage.) The phishing emails distribute the PlugX remote-access Trojan using malicious Microsoft Word documents as vectors.

Meanwhile, Western targets continue to worry about China's Iron Tiger campaign, cyber operations in support of South China Sea territorial claims, and a "pledge of compliance" being required of companies doing business in China.

The Russian services aren't idle either, as F-Secure publishes a useful rundown of their Duke family of exploits.

Some insight into the workings of the exploit industry may be gleaned from the details of a recently discovered point-of-sale Trojan: it's been assembled from pieces of earlier kits.

ESET finds a new bit of crimeware:"Odlanor." This one cheats at online poker.

Schneider Electric pushes out some new firmware for the StruxureWare Building Expert building automation system. The patch stops a bug (not yet believed exploited in the wild) that transmitted plaintext user credentials between servers and client machines.

The UK's MI5 wants, as a matter of policy, extensive access to communications. US crypto policy wars continue, with fresh arguments that universal encryption need not unduly burden law enforcement.

Cyber insurance large print giveth, but small print taketh away: risk from your business partners being phished isn't covered.