Researchers Say China State-backed Hackers Breached a Digital Certificate Authority

A suspected Chinese state-sponsored actor breached a digital certificate authority as well as government and defense agencies in Asia.

Ravie LakshmananNov 15, 2022 A suspected Chinese state-sponsored actor breached a digital certificate authority as well as government and defense agencies located in different countries in Asia as part of an ongoing campaign since at least March 2022. Symantec, by Broadcom Software, linked the attacks to an adversarial group it tracks under the name Billbug, citing the use of tools previously attributed to this actor. The activity appears to be driven by espionage and data-theft, although no data is said to have been stolen to date. Billbug, also called Bronze Elgin, Lotus Blossom,…

saved by

• Luke Blackwell

related reading

• Countering misuse of AI: September 2026 / Anthropicanthropic.com
• Disrupting the first reported AI-orchestrated cyber espionage campaign \ Anthropicanthropic.com
• Hacker wipes Romania's entire land registry databasenews.risky.biz
• Incident Report: unsanctioned agent behaviour during cyber testing | AISI Workaisi.gov.uk
• U.S. government is 'biggest buyer' of zero-day vulnerabilities, report claims | CSO Onlinecsoonline.com
• Inside Sophos' 5-Year War With the Chinese Hackers Hijacking Its Devices | WIREDwired.com
• FBI chief says Chinese hackers have infiltrated critical US infrastructure | China | The Guardiantheguardian.com
• Security incident disclosure — July 2026huggingface.co
• China Possibly Hacking US "Lawful Access" Backdoor - Schneier on Securityschneier.com
• Black Hat USA 2026 | The 'Breaking' News: The OpenAI–Hugging Face Incidentyoutube.com
• Chinese threat actor Storm-0940 uses credentials from password spray attacks from a covert networkmicrosoft.com
• Emergent Cyber Behavior: When AI Agents Become Offensive Threat Actors - Irregularirregular.com