{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "china",
    "label": "China",
    "isStack": false,
    "url": "https://pwn.watch/t/china",
    "feed": "https://pwn.watch/t/china/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 5
  },
  "incidents": [
    {
      "slug": "f5-nation-state-breach-big-ip-source-code-2025",
      "title": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025",
      "json": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "F5 BIG-IP (vendor breach)",
      "tags": [
        "f5",
        "nation-state",
        "china",
        "brickstorm",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "BIG-IP, F5OS, BIG-IP Next and others (see F5 K000154696 and Oct 2025 Quarterly Security Notification)"
      ],
      "fixedVersions": [
        "F5 October 2025 Quarterly Security Notification releases"
      ],
      "startedAt": "2025-08-09",
      "closedAt": "2025-10-15",
      "updatedAt": "2025-10-15",
      "summary": "F5 disclosed that a sophisticated nation-state actor had long-term access to its BIG-IP development and engineering systems and stole parts of the BIG-IP source code, information on undisclosed vulnerabilities and some customer configuration data. CISA issued Emergency Directive 26-01 ordering agencies to inventory and patch F5 gear. Researchers linked it to China-nexus UNC5221 and BRICKSTORM.",
      "xPost": null
    },
    {
      "slug": "salt-typhoon-us-telecom-breaches",
      "title": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches",
      "json": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "US telecommunications carriers",
      "tags": [
        "salt-typhoon",
        "telecom",
        "espionage",
        "china",
        "nation-state"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-11-13",
      "closedAt": "2024-12-04",
      "updatedAt": "2024-12-04",
      "summary": "PRC-affiliated actors (publicly called Salt Typhoon) compromised networks at multiple US telecommunications companies. The FBI and CISA said they stole customer call records, got into the private communications of a limited number of people mainly involved in government or political activity, and copied information subject to US law enforcement wiretap requests. Allied agencies then published hardening guidance for communications infrastructure.",
      "xPost": null
    },
    {
      "slug": "atlassian-confluence-admin-creation-cve-2023-22515",
      "title": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515",
      "json": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Atlassian Confluence Data Center and Server",
      "tags": [
        "java",
        "atlassian",
        "confluence",
        "zero-day",
        "auth-bypass",
        "china",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-22515"
      ],
      "affectedVersions": [
        "8.0.0 to 8.5.1 (Atlassian advisory)"
      ],
      "fixedVersions": [
        "8.3.3",
        "8.4.3",
        "8.5.2 (LTS)"
      ],
      "startedAt": "2023-10-04",
      "closedAt": "2023-10-16",
      "updatedAt": "2023-10-16",
      "summary": "A broken access control bug in publicly reachable Confluence Data Center and Server let outside attackers create Confluence administrator accounts. It was exploited as a zero-day, and Microsoft attributed it to the China-nexus Storm-0062. Atlassian Cloud was not affected.",
      "xPost": null
    },
    {
      "slug": "barracuda-esg-zero-day-cve-2023-2868",
      "title": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868",
      "json": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Barracuda Email Security Gateway (appliance)",
      "tags": [
        "barracuda",
        "email-security",
        "zero-day",
        "rce",
        "china",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-2868"
      ],
      "affectedVersions": [
        "5.1.3.001 to 9.2.0.006 (appliance form factor only) (NVD)"
      ],
      "fixedVersions": [
        "See vendor advisory (patch pushed to all appliances May 20–21, 2023; compromised appliances must be replaced)"
      ],
      "startedAt": "2023-05-18",
      "closedAt": "2023-06-15",
      "updatedAt": "2023-06-15",
      "summary": "A command injection in how Barracuda ESG appliances scan .tar attachments was exploited since October 2022 by China-nexus UNC4841 to backdoor appliances. Barracuda later told customers to replace compromised appliances outright, even after patching.",
      "xPost": null
    },
    {
      "slug": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "title": "Storm-0558: stolen Microsoft signing key used to read government email",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "json": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)",
      "tags": [
        "microsoft",
        "microsoft-365",
        "exchange-online",
        "azure",
        "china",
        "token-forgery",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-05-15",
      "closedAt": "2023-09-06",
      "updatedAt": "2023-09-06",
      "summary": "China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "f5-nation-state-breach-big-ip-source-code-2025",
      "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-15",
      "title": "F5 discloses the breach (SEC 8-K) and ships patches",
      "body": null,
      "sourceUrl": "https://my.f5.com/manage/s/article/K000154696",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025"
    },
    {
      "incident": "f5-nation-state-breach-big-ip-source-code-2025",
      "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-10-15",
      "title": "CISA issues Emergency Directive 26-01 for F5 devices",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-26-01-mitigate-vulnerabilities-f5-devices",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025"
    },
    {
      "incident": "f5-nation-state-breach-big-ip-source-code-2025",
      "incidentTitle": "F5 breached by nation-state actor: BIG-IP source code and undisclosed bugs stolen",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-09",
      "title": "F5 learns of the intrusion",
      "body": null,
      "sourceUrl": "https://www.sec.gov/Archives/edgar/data/1048695/000104869525000149/ffiv-20251015.htm",
      "url": "https://pwn.watch/i/f5-nation-state-breach-big-ip-source-code-2025"
    },
    {
      "incident": "salt-typhoon-us-telecom-breaches",
      "incidentTitle": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-12-04",
      "title": "CISA, NSA, FBI and Five Eyes partners release hardening guidance for communications infrastructure",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/resources-tools/resources/enhanced-visibility-and-hardening-guidance-communications-infrastructure",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches"
    },
    {
      "incident": "salt-typhoon-us-telecom-breaches",
      "incidentTitle": "Salt Typhoon: Chinese state hackers inside US telecom networks",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-11-13",
      "title": "FBI and CISA joint statement on PRC targeting of commercial telecommunications",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/news/joint-statement-fbi-and-cisa-peoples-republic-china-prc-targeting-commercial-telecommunications",
      "url": "https://pwn.watch/i/salt-typhoon-us-telecom-breaches"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-16",
      "title": "CISA, FBI and MS-ISAC joint advisory AA23-289A on active exploitation",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-289a",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-05",
      "title": "CISA adds CVE-2023-22515 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "atlassian-confluence-admin-creation-cve-2023-22515",
      "incidentTitle": "Confluence Data Center/Server zero-day lets attackers create admins (CVE-2023-22515)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "Atlassian discloses the zero-day after customer reports and ships fixes",
      "body": null,
      "sourceUrl": "https://confluence.atlassian.com/security/cve-2023-22515-broken-access-control-vulnerability-in-confluence-data-center-and-server-1295682276.html",
      "url": "https://pwn.watch/i/atlassian-confluence-admin-creation-cve-2023-22515"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-06",
      "title": "Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-14",
      "title": "Microsoft details how the stolen MSA key was used to forge tokens",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-07-11",
      "title": "Microsoft discloses the intrusion; CISA and FBI publish AA23-193A",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-16",
      "title": "Microsoft opens an investigation after a customer reports anomalous mail access",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    },
    {
      "incident": "barracuda-esg-zero-day-cve-2023-2868",
      "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-15",
      "title": "Mandiant attributes the campaign to China-nexus UNC4841",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/barracuda-esg-exploited-globally",
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868"
    },
    {
      "incident": "barracuda-esg-zero-day-cve-2023-2868",
      "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-06-06",
      "title": "Barracuda tells customers to replace compromised appliances immediately, regardless of patch level",
      "body": null,
      "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability",
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868"
    },
    {
      "incident": "barracuda-esg-zero-day-cve-2023-2868",
      "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-30",
      "title": "Barracuda: exploitation dates back to October 2022, with SALTWATER, SEASPY and SEASIDE malware",
      "body": null,
      "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability",
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868"
    },
    {
      "incident": "barracuda-esg-zero-day-cve-2023-2868",
      "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-26",
      "title": "CISA adds CVE-2023-2868 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868"
    },
    {
      "incident": "barracuda-esg-zero-day-cve-2023-2868",
      "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-20",
      "title": "Security patch pushed to all ESG appliances worldwide",
      "body": null,
      "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability",
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868"
    },
    {
      "incident": "barracuda-esg-zero-day-cve-2023-2868",
      "incidentTitle": "Barracuda Email Security Gateway zero-day (CVE-2023-2868)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-18",
      "title": "Barracuda notices anomalous traffic from ESG appliances",
      "body": null,
      "sourceUrl": "https://www.barracuda.com/company/legal/esg-vulnerability",
      "url": "https://pwn.watch/i/barracuda-esg-zero-day-cve-2023-2868"
    },
    {
      "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023",
      "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-15",
      "title": "Storm-0558 begins accessing customer email with forged tokens",
      "body": null,
      "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/",
      "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023"
    }
  ]
}