Signs point to Chinese intelligence services as the operators behind the recent hack and attendant data breach at the Australian National University. The Sydney Morning Herald says investigators believe one of the campaign's principal objectives was to groom Australian students headed into civil service careers for recruitment as agents.

The risks of Remote Desktop Protocol vulnerabilities come into sharper focus. Morphus Labs warns that a botnet, "GoldBrute," is scanning and brute-forcing about a million-and-a-half RDP servers.

Iran's hacking group MuddyWater (also known as SeedWorm) might have seen more of its tools leaked online, but that hasn't made it pull in its horns. Clearsky warns that the threat group is actively impersonating government accounts and using at least two new techniques: Microsoft documents carrying malicious macros, and exploitation of  CVE-2017-0199 (that is, Microsoft Office/WordPad Remote Code Execution Vulnerability with Windows API). These of course aren't new attack tactics, but they're new for MuddyWater, and represent Iranian intelligence and security services' longstanding determination to learn lessons and improve their game.

The RIG exploit kit is now being used to deliver Buran ransomware, BleepingComputer reports. The best defenses against this Russian strain of ransomware ("буран," "blizzard") are updated security software (since Buran arrives via exploit kits), sound offline backup, and properly suspicious users.

Cryptocurrency firms are under attack, Infosecurity Magazine says. GateHub users lost some $9.7 million, and blockchain startup Komodo (not to be confused with security firm Comodo) hastily patched a vulnerability in its wallet.

The US Nuclear Regulatory Commission is short cyberworkers.