Freelance journalist. Former Nairobi, Kampala, Beirut, Beijing and Brussels. Now back in Europe. https://xitter.cf/t.co/xAvd9VutO0.

Joined April 2009
You mean like ALL their globally accessible websites !?!?!?
BREAKING: North Korea's internet hit by massive cyberattack, knocking more than 40 government websites offline.
58
New: I got a tip a little while ago about a shadowy Pentagon entity called "TSO" with a lot of money and a desire for offensive hacking tools. Turns out TSO is a new DoD agency. And it does a lot more than hacking. w/@JackDetsch and @paulmcleary politico.com/news/2026/10/22…
15
372
28
846
103,262
If for any reason there are problems accessing Joshua Michael's Flock camera map, Proton is hosting a copy. proton.me/flock-camera-map
5
23
1
153
7,643
Wait, a while ago all the pundits and many China-watchers assured the world that the times of this shenanigans are over as Beijing and Delhi are now having a direct line of communication or something along the line.
印度媒体公布的更多今年7月下旬中印边境对峙画面
72
marc hofer retweeted
Yahoo is still blocking emails from our newly assigned IP space. We've continued using it and aren't going to stop because Yahoo won't accept mails from it. It already has a great reputation elsewhere and there are 0 issues with anything else blocking it. xitter.cf/GrapheneOS/status/2111…
Yahoo is still blocking emails from our newly assigned IPv4 space (206.220.120.0/22). It's likely they're behind on updating their database of allocated IP space. It was already published via arin.net/resources/guide/ipv… and other providers have been accepting it for 2 weeks already.
23
45
2
1,152
27,980
marc hofer retweeted
A recent internal report by the company 北京华崮科技有限公司 (Beijing Huagu Technology) about the Chinese IT investment landscape lays bare its chaotic and unstructured nature. Spiraling costs, lack of standardization of project-spending-estimation and quickly changing requirements are a real challenge for many medium size companies. Resulting in a high turnover in the industry. 1/2
33
5
33
3,906
marc hofer retweeted
New: Chinese hackers broke into Staples. Staples has an internal customer support tool called Nexus, Chinese hackers got into that, issued millions of dollars of gift cards. Mules then went on a spending spree across the U.S. Gang made $100 million+ 404media.co/how-a-massive-ch…
52
445
53
3,023
284,355
marc hofer retweeted
What a rollercoaster. 7 weeks, 5 RCEs on Pixel 10 & 11, all officially patched by Google today. Chuffed to bits. The bounty won’t have us popping champagne, but popping Chrome? That we can do all day. The real payout was always the patch. Demo 👇
5
18
2
133
14,620
marc hofer retweeted
Investors/board members/ceos are taking a giant leap of faith to think they can rely on future PRC open AI models going forward. Those with fiduciary duties will need a rethink
The Mofcom explainer of the revised export control rules. sinocism.notion.site/MOFCOM-… risks of building a business on PRC open AI models going up. “facilitation measures such as automatic licensing may apply if they are deployed in relatively controllable-risk circumstances, such as on a company’s own cloud infrastructure overseas 如果部署在海外自有云等风险相对可控的情形下,可适用自动许可等便利措施”
3
7
1
25
4,355
marc hofer retweeted
Seen these ads for Akedo, an AliExpress “Sale”, or MyIPInfo? They’re being run en masse by an Israeli ads company called Discover-Tech as part of an espionage scheme we call AdFection, and they have the potential to infect you with spyware when (or even before) you see them
3
17
1
40
2,549
marc hofer retweeted
We found source code for another Chinese made Darksword/Coruna-scam-kit that mentions its iOS26 compatibility with an extension they call 'Divine Seagull'. Is it the real thing or just another round of R&D and window-dressing ? 1/3
4
15
113
9,795
marc hofer retweeted
NEW: 🇳🇴 Chinese-owned rental cars used by the Norwegian Armed Forces reportedly recorded soldiers, their movements and security codes during a major military exercise in Oslo, raising serious questions about the security of vehicles used in sensitive military operations. The incident occurred during Operation Hovedstad, held from September 14 to 18, when Norway’s Home Guard District 02 trained for security operations, including scenarios involving the defence of Oslo Airport during wartime. The Armed Forces had rented the cars through Hertz Norway under a nationwide rental agreement signed in 2024, worth up to 350 million Norwegian kroner and running until May 2028. Hertz Norway’s ownership chain ultimately leads to China’s Zhejiang Geely Holding Group, which also owns Volvo Cars. The agreement provides rental vehicles for exercises, operational activities and everyday military use. During the exercise, soldiers discovered that the cars had recorded and stored video footage. Lieutenant Fredrik Blanck told Norwegian newspaper Dagens Næringsliv (DN) that the recordings showed who entered and exited the vehicles, where they travelled, whom they picked up and how long they remained at different locations. More concerningly, the footage reportedly captured security codes entered by soldiers when opening military gates. Some access points require both a key card and a code, meaning the recordings could expose sensitive access procedures. The vehicles remained in use throughout the exercise because alternative transport was in limited supply.
245
1,499
338
3,651
290,906
marc hofer retweeted
.@EmilyZFeng: “The Uyghur fighters rode into Damascus on tanks and armored vehicles, waving their guns and light blue East Turkestan nationalist flags…All of them were thinking of home. ‘I thought, if only it were Hotan, or Aksu, or Urumqi.’” chinabooksreview.com/2026/10…
2
2
3
1,953
marc hofer retweeted
The CyberStrikeAI and ARTEX combination by Chinese-speaking offensive actors is an interesting trend we’re following closely 👇
INTEL DROP AI-native offensive tooling is stacking on single hosts. Total Insights Feed detection pipeline currently sees 1,989 IPs running an AI pentest framework, and 48 of them run two or more. Many share IPs with classic C2, stolen AI API relays, and exposed gen-AI apps. A sample of 8, in the US, China, Hong Kong, Singapore, and Iran: 192.236.166.73 cyberstrikeai + artex + mythic + scopesentry + ai-relay:grok2api 192.253.229.113 cyberstrikeai + artex + pentagi + xingrin 149.104.24.91 cyberstrikeai + artex + arl + ai-relay:sub2api 151.243.126.22 cyberstrikeai + sliver + gen-ai:n8n + gen-ai:openclaw + ai-relay:new-api 103.101.176.236 cyberstrikeai + pentagi + malware-hosting + open-dir 64.20.61.134 pentagi + ai-relay:sub2api + ai-relay:grok2api + open-dir 1.14.104.208 pentagi + adaptixc2 + cobaltstrike 119.45.122.90 deepaudit + gen-ai:ollama + gen-ai:open-webui + gen-ai:openclaw + scanner Several also expose a Known-Exploited-Vulnerability service (kev-vulnerable) on the same host that runs the attack tooling. Happy hunting! #TotalInsights #ThreatIntel #AI #OffensiveSecurity #CyberStrikeAI team-cymru.com/total-insight…
2
19
1
110
13,334
There are like dozens of them out there now. Another very popular one is CyberStrikeAI.
Apparently this is an open-source Chinese AI agentic cybersecurity tool called ARTEX. It seems to be model agnostic--meaning you can plug in your own API keys and choose which models to use.
118
marc hofer retweeted
1/ How I infiltrated a Chinese organized crime syndicate that has laundered $1B+ across multiple exploits for Lazarus Group. Posing as a client, I gathered intel that helped action freezes for the Feb 2025 Bybit exploit and attribute illicit activity onchain.
1,941
4,197
1,300
30,405
4,845,175
And last, The Swarmchasers team (including @rogesterone) found evidence of a Tencent agent fleet: swarmcha.se/posts/chinese-ag…
6
18
17
254
61,496
Spain has converted itself, over four years and four PM visits, from a hedging middle power into the closest thing Beijing has to a model relationship inside the EU. 1/11
5
123
13
287
20,546