Real-time global intelligence

© 2026 OpenWatch. All rights reserved.

Proudly using no third-party tracking

Illustrative, not investment advice. OpenWatch aggregates public signals for research and information only — it is not personalized financial, legal, or tax advice, and nothing here is a recommendation to buy or sell any security.

Platform

Brief
Signals
Cascade
Trajectories
Wagers
Track Record
Countries
Companies
Industries
Themes
Rankings

Tools

Globe
Analytics
Crises
Clusters
Supply Chain
Alliances
Screener
Watchlist
Portfolio

Developer

Status

Sources

View all sources →

1,000+ tracked sources

Signals updated every 15 minutes

Not investment advice. OpenWatch is provided for informational and entertainment purposes only. While we strive for accuracy, precision, and source attribution in all intelligence assessments, geopolitical analysis involves inherent uncertainty and our conclusions may be incomplete, delayed, or incorrect. Nothing on this platform constitutes financial, investment, legal, or professional advice of any kind. Forward-looking scenarios and probability estimates are analytical hypotheses — not independently validated forecasts. Any actions taken based on information found here are solely your responsibility. Always consult a qualified financial advisor before making investment decisions. Past signal patterns do not guarantee future outcomes.

Methodology
Privacy Policy
Terms of Use

openwatch.io

v·eed287a

Search

Congressional trades, bills, prediction markets, hearings, and intelligence signals. Signal search supports: AND OR "exact phrase" -exclude

Keywords

Threat Layer

Military Cyber Economic Disaster Political Criminal Health Supply Chain

Signal Type

Any Crisis Update Resolution

Region

Country

Min. Severity

Any ≥ 3 ≥ 5 ≥ 7 ≥ 9

Date Range

Clear all filters

Sort by

Severity Newest

↓Export CSV (requires API key)

Themes:🧠AI Chip Bottleneck 🛡US Defense Surge 🔌Taiwan Semiconductor Risk 🏗India Infrastructure Supercycle

23 signals for Cyber · China · Crisis

Page 1 of 1

CyberCrisis🇨🇳China55d ago

A China-linked hacking group tracked as UAT-8302 has been conducting targeted intrusions against government institutions in South America and southeastern Europe, deploying custom-built malware in what researchers at Cisco Talos describe as an ongoing advanced persistent threat campaign stretching from late 2024 into 2025.

7.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇧🇷Brazil 🇦🇷Argentina+256d ago

Cisco Talos has identified a sophisticated Chinese state-linked hacking group, UAT-8302, that has been systematically targeting government institutions in South America since late 2024 and southeastern Europe in 2025, in what appears to be a coordinated espionage campaign spanning multiple continents.

7.0/10·Cisco Talos Intelligence

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇺🇸United States 🇪🇺EU+324d ago

Russian military early-warning satellites have caused at least 75 GPS signal disruptions across Europe since 2019, according to a joint study by the University of Texas and Spanish firm GMV reviewed by The New York Times. The interference, lasting under ten seconds per incident, affects US, Chinese, and EU positioning systems while sparing Russian GLONASS. Researchers warn that while individual disruptions are minor, the capability to selectively jam GPS across 450 kilometers—including critical infrastructure like power grids and cellular networks—fundamentally changes vulnerability assessments for NATO and European defense systems.

6.8/10·The Insider Russia

Primary Source ↗Details →

CyberCrisis🇨🇳China40d ago

A Chinese cyber-espionage operation has been discovered targeting telecommunications providers worldwide using previously unknown malware for both Linux and Windows systems. Security researchers identified the malware variants as Showboat and JFMBackdoor, suggesting a sophisticated, sustained effort to establish persistent backdoor access to telecom infrastructure.

6.5/10·Bleeping Computer

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇨🇳China 🇷🇺Russia+240d ago

Popular @antv npm packages have been compromised with malware that steals CI/CD secrets from developers' systems. The 'Mini Shai-Hulud' payload executes during npm install and exfiltrates credentials for GitHub, AWS, Kubernetes, Vault, npm, and 1Password from Linux automation environments.

6.5/10·Microsoft Security Blog

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇬🇧United Kingdom 🇦🇺Australia+325d ago

The Five Eyes intelligence alliance—comprising security agencies from Britain, the United States, Australia, Canada, and New Zealand—has issued a public warning about Chinese military intelligence services conducting a coordinated social engineering operation. The campaign uses fraudulent job postings for foreign policy and defence analyst positions on LinkedIn and similar platforms to infiltrate and extract sensitive information from Western government staff.

6.2/10·Hong Kong Free Press

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇮🇳India 🇨🇳China57d ago

The Chinese cybercrime group Silver Fox, known by multiple aliases including Monarch and Void Arachne, has been linked to a new malware campaign targeting organizations across Russia and India. The attackers deployed a previously unknown malware called ABCDoor through phishing emails spoofing correspondence from India's Income Tax Department in December 2025, with similar attacks reported to have continued afterward.

6.2/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇨🇦Canada 🇲🇱Mali15d ago

Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇷🇺Russia50d ago

Executive Summary Since our February 2026 report on AI-related threat activity, Google Threat Intelligence Group (GTIG) has continued to track a maturing transition from nascent AI-enabled operations to the industrial-scale application of generative models within adversarial workflows. This report, based on insights derived from Mandiant incident response engagements, Gemini, and GTIG’s proactive research, highlights the dual nature of the current threat environment where AI serves as both a sophisticated engine for adversary operations and a high-value target for attacks. We explore the following developments: Vulnerability Discovery and Exploit Generation: For the first time, GTIG has identified a threat actor using a zero-day exploit that we believe was developed with AI.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇰🇵North Korea 🇲🇱Mali+1117d ago

Written by: Casey Charrier, James Sadowski, Zander Work, Clement Lecigne, Benoît Sevens, Fred Plan Executive Summary Google Threat Intelligence Group (GTIG) tracked 90 zero-day vulnerabilities exploited in-the-wild in 2025. Although that volume of zero-days is lower than the record high observed in 2023 (100), it is higher than 2024’s count (78) and remained within the 60–100 range established over the previous four years, indicating a trend toward stabilization at these levels. In 2025, we continued to observe the structural shift, first identified in 2024, toward increased enterprise exploitation.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇲🇱Mali125d ago

Introduction Last week, Google Threat Intelligence Group (GTIG), Mandiant, and partners took action to disrupt a global espionage campaign targeting telecommunications and government organizations in dozens of nations across four continents. The threat actor, UNC2814, is a suspected People's Republic of China (PRC)-nexus cyber espionage group that GTIG has tracked since 2017. This prolific, elusive actor has a long history of targeting international governments and global telecommunications organizations across Africa, Asia, and the Americas and had confirmed intrusions in 42 countries when the disruption was executed.

6.1/10·Mandiant Threat Intelligence·Mali

Primary Source ↗Details →

CyberCrisis🇮🇷Iran 🇨🇳China 🇷🇺Russia138d ago

Introduction In the final quarter of 2025, Google Threat Intelligence Group (GTIG) observed threat actors increasingly integrating artificial intelligence (AI) to accelerate the attack lifecycle, achieving productivity gains in reconnaissance, social engineering, and malware development. This report serves as an update to our November 2025 findings regarding the advances in threat actor usage of AI tools. By identifying these early indicators and offensive proofs of concept, GTIG aims to arm defenders with the intelligence necessary to anticipate the next phase of AI-enabled threats, proactively thwart malicious activity, and continually strengthen both our classifiers and model.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇨🇳China 🇦🇺Australia+2140d ago

Introduction In modern warfare, the front lines are no longer confined to the battlefield; they extend directly into the servers and supply chains of the industry that safeguards the nation. Today, the defense sector faces a relentless barrage of cyber operations conducted by state-sponsored actors and criminal groups alike. In recent years, Google Threat Intelligence Group (GTIG) has observed several distinct areas of focus in adversarial targeting of the defense industrial base (DIB).

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇷🇺Russia 🇨🇳China 🇧🇷Brazil+1154d ago

Introduction The Google Threat Intelligence Group (GTIG) has identified widespread, active exploitation of the critical vulnerability CVE-2025-8088 in WinRAR, a popular file archiver tool for Windows, to establish initial access and deliver diverse payloads. Discovered and patched in July 2025, government-backed threat actors linked to Russia and China as well as financially motivated threat actors continue to exploit this n-day across disparate operations. The consistent exploitation method, a path traversal flaw allowing files to be dropped into the Windows Startup folder for persistence, underscores a defensive gap in fundamental application security and user awareness.

6.1/10·Mandiant Threat Intelligence

Primary Source ↗Details →

CyberCrisis🇨🇳China 🇮🇹Italy 🇲🇰North Macedonia+2176d ago

High Vulnerabilities Primary Vendor -- Product Description Published CVSS Score Source Info Patch Info SmarterTools--SmarterMail Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution. 2025-12-29 10 CVE-2025-52691 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-124/   MiniDVBLinux--MiniDVBLinux MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

6.1/10·US-CERT Bulletins·Mali

Primary Source ↗Details →

CyberCrisis🇰🇵North Korea 🇨🇳China56d ago

The North Korean state-sponsored hacking group ScarCruft infiltrated a video game platform's software supply chain, embedding a backdoor called BirdCall into its components to spy on ethnic Koreans living in China — marking a shift from the group's previous Windows-only targeting approach.

6.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇨🇳China56d ago

Attackers are actively exploiting a critical remote code execution flaw in Weaver E-cology, a popular enterprise office automation platform, with a CVSS score of 9.8 — meaning no login is required to compromise affected systems running versions released before March 12, 2026.

6.0/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇨🇳China56d ago

A Chinese state-backed hacking group has sent more than 1,600 targeted phishing messages to victims across multiple industries, using the attacks to install newly discovered malware including a backdoor called ABCDoor and a remote access tool known as ValleyRAT.

5.5/10·Dark Reading

Primary Source ↗Details →

CyberCrisis🇨🇦Canada 🇨🇳China 🇭🇰Hong Kong+3153d ago

Introduction This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA’s proxy infrastructure is a little-known component of the digital ecosystem leveraged by a wide array of bad actors. This disruption, led by Google Threat Intelligence Group (GTIG) in partnership with other teams, included three main actions: Took legal action to take down domains used to control devices and proxy traffic through them.

5.5/10·Mandiant Threat Intelligence·Hong Kong, Central and Western

Primary Source ↗Details →

CyberCrisis🇨🇳China53d ago

The cybersecurity firm has not explicitly accused China of being behind the attack, but the evidence suggests it was. The post Palo Alto Zero-Day Exploited in Campaign Bearing Hallmarks of Chinese State Hacking appeared first on SecurityWeek .

5.3/10·SecurityWeek

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇨🇳China 🇷🇺Russia+218d ago

Authorities in Europe have disrupted AudiA6, a cryptocurrency laundering service used by ransomware gangs and cybercriminal networks. Europol, in a statement issued Thursday, said the dismantling of AudiA6 cut off a "key financial pipeline used to wash hundreds of millions in illicit profits." The service is estimated to have been used to launder more than €336 million (~$389 million) since the

4.1/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇨🇳China 🇷🇺Russia+212d ago

Threat actors associated with the DragonForce ransomware have been observed using a custom Go-based remote access trojan (RAT) called Backdoor.Turn to conceal command-and-control (C2) traffic inside Microsoft Teams relay infrastructure. According to findings from Broadcom-owned Symantec and Carbon Black, the backdoor was deployed against a major U.S. services firm.

3.9/10·The Hacker News

Primary Source ↗Details →

CyberCrisis🇺🇸United States 🇨🇳China 🇷🇺Russia+221d ago

University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, generate tailored attack strategies for each target it encounters, and replicate itself, all without human intervention and without touching a commercial AI service. The preprint, posted to arXiv on

3.5/10·The Hacker News

Primary Source ↗Details →