⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground.
Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver.
Exploitation of KnowledgeDeliver via ViewState Deserialization Vulnerability. Written by: Takahiro Sugiyama, Peter Revelant, Mathew Potaczek Introduction In late 2025, Mandiant responded to a security incident involving a compromised web server running KnowledgeDeliver.
2 PhaaS 2 Furious: The Evolution of Chinese-Language Phishing Services. While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground.
While Russian-speaking threat actors have historically dominated the phishing-as-a-service (PhaaS) landscape, a rival ecosystem is rapidly growing within the Chinese-language underground. Google Threat Intelligence Group (GTIG) analyzed a dozen current PhaaS offerings in the Chinese underground, all of them mature services and many likely tied intricately to the broader criminal ecosystem in that region.
Mandiant investigated a compromised KnowledgeDeliver server, finding a vulnerability caused by identical hardcoded ASP.NET machine keys across deployments. This allowed an unknown threat actor to perform ViewState deserialization and achieve unauthenticated remote code execution.