Cyberconflict and warfare

North Korean hackers switch to ransomware in major cyber campaign

A North Korean hacking unit has launched a ransomware campaign targeting South Korea and other countries, marking a shift from pure espionage. Security firm S2W identified the subgroup, ‘ChinopuNK’, as part of the ScarCruft threat actor.

The operation began in July, utilising phishing emails and a malicious shortcut file within a RAR archive to deploy multiple malware types. These included a keylogger, stealer, ransomware, and a backdoor.

ScarCruft, active since 2016, has targeted defectors, journalists, and government agencies. Researchers say the move to ransomware indicates either a new revenue stream or a more disruptive mission.

The campaign has expanded beyond South Korea to Japan, Vietnam, Russia, Nepal, and the Middle East. Analysts note the group’s technical sophistication has improved in recent years.

Security experts advise monitoring URLs, file hashes, behaviour-based indicators, and ongoing tracking of ScarCruft’s tools and infrastructure, to detect related campaigns from North Korea and other countries early.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Employee data compromised in cyberattack on Canada’s parliament

Canada’s House of Commons is investigating a data breach after a cyberattack reportedly exploited a Microsoft vulnerability, granting unauthorised access to a database for managing parliamentary computers and mobile devices. Staff were notified of the breach this past Monday via internal communications.

The compromised information includes employees’ names, job titles, office locations, email addresses, and device-related details. Authorities have warned individuals to be alert for potential impersonation or phishing attempts using the stolen data.

Canada’s Communications Security Establishment (CSE) supports the investigation and confirms its involvement. No attribution has been made yet, as identifying specific threat actors remains challenging.

While the exact Microsoft vulnerability has not been publicly confirmed, cybersecurity experts point to a critical SharePoint zero-day (CVE-2025-53770), which has seen wide exploitation. The attack underscores the pressing need for robust cyber defence across government essential infrastructures.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Cyber-crime group BlackSuit crippled by $1 million crypto seizure

Law enforcement agencies in the United States and abroad have coordinated a raid to dismantle the BlackSuit ransomware operation, seizing servers and domains and approximately $1 million in cryptocurrency linked to ransom demands.

The action, led by the Department of Justice, Homeland Security Investigations, the Secret Service, the IRS and the FBI, involved cooperation with agencies across the UK, Germany, France, Canada, Ukraine, Ireland and Lithuania.

BlackSuit, a rebranded successor to the Royal ransomware gang and connected to the notorious Conti group, has been active since 2022. It has targeted over 450 US organisations across healthcare, government, manufacturing and education sectors, demanding more than $370 million in ransoms.

The crypto seized was traced back to a 2023 ransom payment of around 49.3 Bitcoin, valued at approximately $1.4 million. Investigators worked with cryptocurrency exchanges to freeze and recover roughly $1 million of those funds in early 2024.

While this marks a significant blow to the gang’s operations, officials warn that without arrests, the threat may persist or re-emerge under new identities.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Ministers urged to forge a secure path for UK government’s digital future

TechUK has issued a comprehensive framework to guide the UK government’s digital transformation, emphasising the importance of secure technological progress as a national imperative.

The proposal outlines three foundational pillars: shaping digital regulation, strengthening countries and regions through digital investment, and advancing international digital trade.

It also calls for sweeping investments in digital skills to ensure citizens are prepared for the digital era. The trade body underscores the need for a digitally confident workforce to sustain the nation’s tech-driven ambitions.

Taken together, these recommendations aim to keep the UK a competitive and resilient digital economy that works for all citizens, supports sustainable growth, and adapts confidently to evolving global digital realities.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Trump’s potential Nvidia deal with China raises national security risks

The US President Donald Trump has shattered decades of US national security precedent by striking a deal with Nvidia and AMD that allows the sale of certain banned AI chips to China, but at a certain price.

In an arrangement without modern parallels, the companies will resume exports of their H20 processors to the Chinese market in exchange for giving the US government a 15% share of related revenues.

The move reopens a channel for sensitive technology sales and introduces a transactional element into what had long been treated as a matter of uncompromising national security.

For decades, Washington’s export controls on strategic technologies were blunt instruments: if a product was deemed too sensitive, no amount of corporate lobbying or lost revenue could override the ban.

Trump’s approach breaks from that tradition, effectively monetising access to restricted technologies. He has even floated the idea of allowing a weakened version of Nvidia’s cutting-edge Blackwell chip to be sold in China, a possibility that has set off alarm bells among national security hawks.

Republican and Democratic lawmakers have condemned the decision, warning it risks transforming US security policy into a ‘pay-for-play’ system.

Representative John Moolenaar, who chairs the House Select Committee on China, argued that export controls should remain a first line of defence against adversaries, not a bargaining chip. His Democratic counterpart, Raja Krishnamoorthi, cautioned that putting a dollar value on national security sends the wrong message to both allies and rivals.

The Trump administration has defended the arrangement by downplaying the risk. Commerce Secretary Howard Lutnick called the H20 Nvidia’s ‘fourth-best’ chip, noting that it is already widely used in China. The administration also framed the move to keep Chinese companies tied to US technology rather than turning to rival suppliers. Yet questions loom over the legality of the revenue-sharing scheme.

Trade experts have raised the possibility that it could be interpreted as an export tax, something the US Constitution prohibits, though details of the agreement remain opaque.

Beyond legal debates, the financial implications are significant. Analysts predict the levy could cut gross margins on China-bound chips by as much as 15 percentage points, trimming overall profitability for Nvidia and AMD.

In turn, this change of course could prompt other US companies selling strategic goods to China, from aerospace to advanced materials, to wonder if they too will face similar revenue-sharing requirements.

For some, it could be a costly burden; for others, it might be the only way to retain access to China’s lucrative market.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Trump weighs scaled-down Nvidia chip sales to China

President Donald Trump has signalled that he may permit Nvidia to sell a toned-down version of its latest Blackwell AI chip to China, which could substantially shift US tech export policy.

The idea, still under discussion with Nvidia CEO Jensen Huang, would involve reducing the chip’s computing power by 30% to 50%, creating what Trump described as an ‘unenhanced’ model for the Chinese market. While framed as a compromise, critics warn that even these stripped-down chips could fuel Beijing’s AI ambitions.

The announcement follows an unprecedented agreement between the Trump administration, Nvidia, and AMD, under which the US government would collect 15% of revenue from certain AI chip sales to China.

Washington insiders have expressed unease, noting that, with enough scaled-down hardware, China could still build AI supercomputers capable of competing with or surpassing American capabilities.

Saif Khan, a former White House technology adviser, cautioned that the move could accelerate China’s path toward AI dominance, undoing years of strict export controls.

Currently, Nvidia’s most advanced chip approved for sale in China is the H20, built on older Hopper architecture. The H20 was specifically designed to comply with restrictions imposed under President Biden and entered the Chinese market in 2024.

Although shipments were halted earlier this year, the Trump administration recently granted clearance for exports to resume. Trump dismissed the H20 as ‘obsolete’ and claimed China had already mastered it, suggesting the new Blackwell variant would offer a fresh revenue stream while staying within national security boundaries.

Nvidia’s flagship US Blackwell chip, unveiled in March 2024, is up to 30 times faster than its predecessor, making it a significant leap in AI performance. Details about the proposed Chinese variant remain undisclosed, but Reuters previously reported it would come at a lower cost and reduced power.

The US Commerce Department has begun issuing licenses for the H20, with officials insisting these exports do not threaten national security.

For Nvidia and AMD, the deal represents a rare case of direct government revenue-sharing tied to foreign sales, reflecting Trump’s hands-on approach to corporate negotiations. His administration has previously pressured tech executives to prioritise domestic manufacturing and has intervened in leadership appointments.

Nvidia, for its part, has stated it will follow all US export rules, while AMD confirmed receiving approval to ship some AI processors to China without directly addressing the revenue-sharing clause.

Beijing’s reaction so far has been muted. China’s foreign ministry declined to comment on the potential Blackwell deal but has repeatedly accused Washington of using technology controls to ‘maliciously contain and suppress’ Chinese industry.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Hubballi emerges as Infosys’ tech hub with Center for AI, cybersecurity, space

Infosys’ decision to launch a Centre for Advanced AI, Cybersecurity & Space Technology in Hubballi deepens its commitment to transforming North Karnataka into a thriving tech hub. The centre, forming part of the company’s global Living Labs network, signals strategic investment in emerging technologies grounded in regional development.

Over 1,000 employees are now based at Hubballi, where the new Living Lab delivers services across sectors such as manufacturing, healthcare, financial services, and space technology. Strategic ties with local academic institutions like IIIT Dharwad are intended to nurture future-ready talent close to operations.

Local leaders framed the centre as a corrective to past underutilisation concerns and a driver of industry-academia collaboration. By encouraging expansion to other districts, they set the tone for inclusive growth and long-term innovation across North Karnataka.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Cyber Force proposal gains momentum in Washington

A new commission will begin work next month to explore creating a standalone Cyber Force as a military service. The Centre for Strategic and International Studies leads the effort in collaboration with the Cyber Solarium Commission 2.0.

The study responds to ongoing weaknesses in how the US military organises, trains and equips personnel for cyber operations. These shortcomings have prompted calls for a dedicated force with a focused mission.

The Cyber Force would aim to improve readiness and capability in the digital domain, mirroring the structure of other service branches. Cyber operations are seen as increasingly central to national security.

Details of the commission’s work will emerge in the coming months as discussions shape what such a force might look like.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Android spyware posing as antivirus

LunaSpy is a new Android spyware campaign disguised as an antivirus or banking protection app. It spreads via messenger links and fake channels, tricking users into installing what appears to be a helpful security tool.

Once installed, the app mimics a real scanner, shows fake threat detections and operates unnoticed. In reality, it monitors everything on the device and sends sensitive data to attackers.

Active since at least February 2025, LunaSpy spreads through hijacked contact accounts and emerging Telegram channels. It poses as legitimate software to build trust before beginning surveillance.

Android users must avoid apps from unofficial links, scrutinise messenger invites, and only install from trusted stores. Reliable antivirus software and cautious permission granting provide essential defence.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!

Microsoft offers $5 million for cloud and AI vulnerabilities

Microsoft is offering security researchers up to $5 million for uncovering critical vulnerabilities in its products, with a focus on cloud and AI systems. The Zero Day Quest contest will return in spring 2026, following a $1.6 million payout in its previous edition.

Researchers are invited to submit discoveries between 4 August and 4 October 2025, targeting Azure, Copilot, M365, and other significant services. High-severity flaws are eligible for a 50% bonus payout, increasing the incentive for impactful findings.

Top participants will receive exclusive invitations to a live hacking event at Microsoft’s Redmond campus. The event promises collaboration with product teams and the Microsoft Security Response Centre.

Training from Microsoft’s AI Red Team and other internal experts will also be available. The company encourages public disclosure of patched findings to support the broader cybersecurity community.

The competition aligns with Microsoft’s Secure Future Initiative, which aims to strengthen cloud and AI security by default, design, and operation. Vulnerabilities will be disclosed transparently, even if no customer action is needed.

Full details and submission rules are available through the MSRC Researcher Portal. All reports will be subject to Microsoft’s bug bounty terms.

Would you like to learn more about AI, tech and digital diplomacy? If so, ask our Diplo chatbot!