government Archives

Winsage

August 25, 2026

Microsoft had to change the anti-piracy hologram on the Windows 95 box because an undisclosed government assumed the baby on it was naked

The original Windows 95 packaging featured two distinct anti-piracy holograms, which served as marks of authenticity. One hologram depicted a shirtless child pointing at a Microsoft logo, which raised concerns from a government entity, leading Microsoft to create a revised version with the child dressed in a shirt and overalls and altering the child's pose. The original hologram has become a collector's item, especially after a recent YouTube short featuring it gained popularity. The child in the hologram would now be in their mid-30s.

AppWizard

August 23, 2026

Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices

A new Android malware threat, codenamed Manic, poses significant risks to Ukrainian banks, government services, and messaging applications, with a reach extending to Russian and European financial institutions, global fintech platforms, cryptocurrency services, and military communication channels. Manic combines Android banking malware and mobile spyware, targeting sensitive applications and enabling comprehensive device takeover. It features a novel Wi-Fi mesh technique for data relay through compromised devices and utilizes phishing sites and dropper apps. The malware originated in February 2026, with initial development leading to its first deployment by late May. It monitors 169 package IDs related to banks, payment services, and messaging applications, primarily affecting Ukrainian targets but also impacting applications in Russia and Europe. Manic can infiltrate commercial and military messaging apps, track locations, monitor notifications, and collect files. It exploits Android's accessibility services to capture sensitive data and employs a store-and-forward relay mechanism for data exfiltration through nearby compromised devices. Google has stated that no apps containing this malware are found on Google Play, and Android users are protected by Google Play Protect.

Winsage

August 23, 2026

China orders state agencies to uninstall Microsoft Windows: Report | Local Linux makers shares rose following report

China's Ministry of State Security has directed certain state-affiliated organizations to remove a tailored version of Microsoft's Windows 10 and transition to domestic alternatives built on the Linux platform, emphasizing data security and reducing reliance on foreign technology. This recommendation was made public on August 21.

AppWizard

August 21, 2026

Beyond These Stars Arrives Oct 15 on PC Game Pass With Full 1.0 Launch

Hooded Horse and Balancing Monkey Games will release Beyond These Stars on October 15, 2026. The game is a city-building and colony management title set on the back of a sentient Space Whale named Kewa. It will be available on Steam, GOG, Epic Games Store, and the Microsoft Store, with day-one access for PC Game Pass subscribers. Beyond These Stars serves as a sequel to Before We Leave and features players guiding a civilization called the Peeps while managing resources and Kewa's well-being. The game emphasizes ecological mutualism, where Kewa's happiness affects gameplay. Players will navigate a complex production system and can explore a procedurally generated Galaxy Map with various star systems. The game has received positive feedback from critics and will launch as a complete 1.0 title, bypassing Early Access. The minimum system requirements include a Windows 10 (64-bit) PC with an Intel Core i3-6300 or AMD FX-9370, 8 GB RAM, and an NVIDIA GTX 750 or AMD Radeon R9 380. A free demo is currently available on Steam.

AppWizard

August 19, 2026

Stop Killing Games distances itself from GTA 6 leak manifesto: ‘Using illegal means to make a point is unacceptable to us’

A manifesto linked to the leak of Grand Theft Auto 6 has prompted discussions among advocates of the Stop Killing Games campaign, which calls for games with single-player content to include an "offline fallback state." Stop Killing Games has distanced itself from the manifesto, acknowledging the authenticity of the leaks while condemning the illegal actions of the leaker, who is allegedly promoting a memecoin. The organization expressed empathy for the developers at Rockstar, emphasizing the negative impact of leaks on them and the gaming community. They noted the potential legal consequences for the leaker, referencing a past incident involving severe repercussions for a similar breach. At least two additional GTA 6 videos have emerged, with the official reveal scheduled for August 27.

Winsage

August 19, 2026

China’s State-Linked Firms Are Moving Away From Windows 10 Due To Security Concerns, Despite The Custom OS Developed By Microsoft Under Stringent Supervision

The Ministry of State Security in China has ordered the removal of the "Government Edition" of Windows 10 from state-operated organizations due to concerns over cyber vulnerabilities. This version was developed through a collaboration between Microsoft and C&M Information Technologies (CMIT) starting in 2016. The plan to transition away from Windows 10, originally set for February 2027, has been accelerated amid rising national security concerns regarding reliance on U.S. technology. China is exploring alternatives for software, including a custom version of Windows 11, Huawei's HarmonyOS, and state-backed Linux distributions like UnionTech’s UOS and Kylinsoft's Kylinsec. Following the announcement, domestic operating system vendors saw a rise in stock prices. The motivations for this shift are linked to geopolitical tensions with the United States, as China emphasizes its commitment to digital security and technological sovereignty.

Winsage

August 18, 2026

China reportedly orders state agencies to uninstall its government-only edition of Windows 10 — Beijing accelerates planned retirement over data security concerns

China's Ministry of State Security has directed state-linked organizations to remove a tailored version of Windows 10 from their systems, expediting a planned phase-out initially set for February 2027. This directive is driven by data security concerns, although specific vulnerabilities were not disclosed. The customized version, developed by C&M Information Technologies (CMIT), is based on Windows 10 Enterprise but modified to exclude consumer features and ensure updates remain within China. Since its launch in 2017, it has been used by various central agencies. The Chinese government has also encouraged the elimination of foreign-branded computers, leading to the emergence of domestic operating systems. Despite these efforts, as of July 2026, Windows held an 87.64% share of desktop web traffic in China, with Windows 10 accounting for 43.56% of usage. Approximately two in five Chinese desktops still run an unsupported version of Microsoft's software.

Winsage

August 17, 2026

⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More

A suspected advanced persistent threat (APT) group linked to China exploited a newly patched vulnerability in VMware vCenter (CVE-2026-59310), which has a critical CVSS score of 9.8, allowing for arbitrary code execution and the deployment of Babuk-derived ransomware. A recently patched vulnerability in Apple macOS (CVE-2026-65400) has been exploited to deploy a cryptocurrency miner, granting unauthorized root access. The Lazarus Group from North Korea exploited a zero-day vulnerability in Microsoft Windows, targeting defense and aerospace sectors. GeoServer patched a critical SQL injection vulnerability that was actively exploited. A new macOS malware, Amnesia Stealer, targets users through ClickFix attacks, stealing data and allowing real-time access to authenticated sessions. A novel attack technique named GhostSplice can manipulate AI coding assistants. Research revealed a method exploiting Chromium's DevTools Protocol for data theft. Noteworthy CVEs this week include CVE-2026-68820, CVE-2026-58231, and multiple others across various platforms. A high-severity command injection flaw in FileRun allows remote code execution. An advanced ClickFix attack has been reported, deploying sophisticated malware. A heap overflow vulnerability in Citrix NetScaler was patched after indications of exploitation. A new malware loader targeting Portuguese-speaking users has been identified. A significant reduction in exposed Automatic Tank Gauge systems has been observed. A phishing campaign targeting Brazil has been detected, and an F.B.I. agent faces charges for unauthorized crypto withdrawals. Authorities in Ukraine dismantled fraudulent call centers, and a North Carolina man was sentenced for cyber extortion. Unauthorized access to sensitive data by the ExfilSquad group has been confirmed. LightSpy activity linked to China has been detected in over 13 countries. A supply chain attack exposed over 2,500 companies, and an Azure exfiltration campaign has exposed millions of enterprise records.

Winsage

August 14, 2026

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth

The threat actor known as HoneyMyte, also referred to as Mustang Panda, has been deploying an upgraded version of the CoolClient backdoor, which includes a signed Windows kernel-mode rootkit. This rootkit enhances the malware's ability to conceal malicious processes, files, registry objects, and command-and-control (C2) network information. Victims have been identified in Myanmar, Mongolia, Pakistan, and Russia, with confirmed targets including government entities. The CoolClient backdoor is deployed as a secondary access layer following an initial PlugX infection. The kernel component activates when CoolClient gains full access to the Service Control Manager (SCM) and the SeTcbPrivilege privilege. If these conditions are not met, the malware bypasses driver deployment and advances to the final-stage implant. Kaspersky has provided indicators of compromise (IoCs), including file hashes, paths, and C2 domains. In a campaign targeting Myanmar, HoneyMyte used PlugX as the initial implant to deploy CoolClient, which involved creating Microsoft Defender exclusions and renaming a legitimate executable for DLL sideloading. Persistence is achieved through a scheduled task that executes the binary with SYSTEM privileges at startup. Execution begins when a legitimate application loads a malicious DLL, which then manages persistence, registry modifications, UAC bypass, process injection, driver deployment, and C2 communications. When privileges are granted, the malware extracts a kernel driver, writes it to disk, and establishes a driver service. The driver is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. The driver receives configuration data from the CoolClient user-mode component and utilizes specific IOCTL requests to register trusted processes and protect filesystem and registry paths. The rootkit can limit access rights to protected processes, hide processes by unlinking them from the active process list, and deny access to protected files and directories. It also filters C2 IPv4 addresses from network information. The driver incorporates 33 IOCTL handlers, but only three were observed in use during standard execution. Kaspersky shared several file hashes related to the malware, including those for the kernel driver and malicious DLLs. This follows earlier disclosures regarding a newer CoolClient variant and a different HoneyMyte kernel-mode rootkit documented in December 2025.

Winsage

August 14, 2026

APT group HoneyMyte upgrades CoolClient: the backdoor gets a kernel-level Windows rootkit

CoolClient is a sophisticated backdoor family linked to the HoneyMyte APT group, actively used in cyber-espionage campaigns targeting organizations in Asia and Russia since its initial disclosure in 2022. It has capabilities such as keylogging, clipboard theft, credential harvesting, and system reconnaissance. Investigations in 2023 revealed enhancements, including clipboard theft and HTTP traffic interception. By late 2025 and into 2026, a variant was noted that could deploy a signed kernel-mode driver as a Windows service, improving its stealth and operational capabilities. In a recent campaign targeting Myanmar, the HoneyMyte group used PlugX to deploy CoolClient components. They configured Microsoft Defender to exclude a fake Windows Defender installation directory and a renamed executable, defender.exe, to avoid detection. Persistence was achieved through a scheduled task that executed defender.exe with SYSTEM privileges at startup, which sideloaded the malicious libngs.dll to initiate the CoolClient execution chain. The latest CoolClient variant has a multi-stage execution chain, including: - defender.exe / Sang.exe: Exploited legitimate application for DLL sideloading. - libsrapc.dll: Benign dependency for the Sangfor application. - libngs.dll: First-stage loader that decrypts and loads the next stage. - loadcert.ini: Second-stage DLL implementing core functionalities. - cert.ini: Final-stage implant for command and control communication. - time.ini: Configuration file for CoolClient. The execution begins with the legitimate Sangfor application loading libngs.dll, which uses obfuscation to conceal its operations. The second stage, loadcert.ini, is injected into synchost.exe and performs tasks including persistence and process injection. The kernel-mode driver deployment routine involves decrypting time.ini, verifying privileges, and creating a service to execute the driver, enhancing stealth. The deployed kernel-mode driver, msagent.sys, is digitally signed and helps hide processes, files, and registry objects, making detection more difficult. The latest variant continues to target organizations consistent with previous HoneyMyte activities, with confirmed victims in Myanmar, Mongolia, Pakistan, and Russia, including government entities. The deployment of CoolClient as a secondary backdoor after a PlugX infection indicates a strategic approach to maintain access to compromised systems. The malware is confirmed as a new variant of CoolClient associated with the HoneyMyte threat group, with the kernel-mode driver marking a significant advancement in its capabilities.