Mustang Panda's target list. Drupalgeddon2 continues. Warnings about older VPNs. Huawei issues. Campaign sites' privacy audit.

Today's issue includes events affecting Australia, China, Czech Republic, Egypt, Germany, Iran, Mongolia, Myanmar, New Zealand, Pakistan, Taiwan, Thailand, United Kingdom, United States, and and Vietnam.

Bring your own context.

On the interpenetration of government and criminal hacking: sometimes crooks become contractors.

"One of the big distinct things about APT41 is the fact that it's conducting both financially motivated cybercrime operations alongside and simultaneously with the cyber espionage campaigns. So, usually with the Chinese espionage groups, they tend to do just the nation-state stuff. If they're doing anything on the side, it's quite a bit separate. But in the case of APT41, there's a lot of overlap between these two worlds within a single group. So, that includes the timing – they're conducting both the financially motivated activity as well as the espionage activity often on the same day, and long-running campaigns running at the same time – but also in terms of the tools they're using.... We think that this group – they have a strong personal interest in the video game industry, and a lot of what they are doing in the financially motivated world is targeted against the video game industry. So a lot of their earlier operations are concentrated against not just video game studios and developers, but also payment platforms and online forums and other related services that are part of the world of video gaming. And a lot of the operations that they're conducting and how they're conducting these operations – the TTPs – will often emerge first in their targeting of video game organizations and then later kind of bleed over into the espionage activities that they're also doing."

—Fred Plan, Senior Analyst on FireEye's Cyber Espionage Threat Intelligence Team, on the CyberWire's Research Saturday, 10.5.19.

Does this lead to any speculation that, you know, they got their start doing non-government type of work and perhaps they caught the government's eye and they said, hey, you guys are doing some interesting work here – how'd you like to come work for us? Is that a possibility or is that just purely speculative?

"It is a possibility, and in fact, we have research dating back to at least 2005, indicating that individuals who were responsible for this activity were advertising hacker-for-hire services. So they were saying they were available for hacking into system networks, and we believe that that was probably in a contractor capacity."

—Nalani Fraser, Senior Manager of the Advanced Analysis Team for FireEye Threat Intelligence, also speaking on the CyberWire's Research Saturday, 10.5.19.

And they go on the government payroll without having to give up their night job, too.