Anthropic reported that in mid-September 2025 a Chinese state-sponsored group ran a large espionage campaign using AI agents to carry out most of the work. About 30 organizations in tech, finance, manufacturing and government were targeted. The attackers used their AI system with Claude Code to handle reconnaissance, vulnerability finding, credential harvesting, back-door setup, data theft and record keeping, while humans stepped in only a few times per operation.

https://www.anthropic.com/news/disrupting-AI-espionage

Eugenio Benincasa writes that in China’s case, many government disclosures by the U.S. and other Western countries have pointed to APT groups and individual operators allegedly linked to provincial bureaus of the Ministry of State Security (MSS), China’s premier civilian intelligence agency. These bureaus function as the operational nerve centres of China’s cyber apparatus. The MSS is not a monolith: it is highly provincialized, with bureaus that cultivate their own bureaucratic interests, talent pipelines, and trusted ecosystems of companies and individual professionals and researchers.

https://nattothoughts.substack.com/p/the-many-arms-of-the-mss-why-provincial

Vulnerability prioritization frameworks such as KEV and EPSS are fundamentally limited because they rely on mass exploitation telemetry and sensor-network–driven signals that act as lagging indicators and miss emerging, high-impact threats. These systems overemphasize low-effort, automated exploitation activity, lack full-spectrum exploit intelligence, and are unable to reliably interpret exploit artifacts or autonomously map them to CVE, resulting in false negatives and delayed response.

In contrast, ARPSyndicate’s Vulnerability & Exploit Data Aggregation System (VEDAS) (https://vedas.arpsyndicate.io) is an early-warning standard that crawls, comprehends, and clusters real-world exploit artifacts globally, assigns its own identifiers to exploitable vulnerabilities, and prioritizes exploit maturity and discovery over noisy mass-exploitation metrics. This approach enabled VEDAS to consistently outperform EPSS and KEV throughout 2025 by surfacing actionable threats before they appeared on conventional radars.

Today, we introduce the VEDAS-driven autonomous generation of Suricata rules for CVEs on GitHub.

This repository is intended to function as an open, collaborative validation environment for Suricata rules autonomously produced by ARPSyndicate’s Vulnerability & Exploit Data Aggregation System (VEDAS). While VEDAS is often associated with offensive research, its capabilities extend strongly into defensive security as well.

Although AI enables the rapid, large-scale generation of detection rules from vulnerability and exploit intelligence, effective security detection depends on transparency, human oversight, and validation in real-world conditions.

By releasing these AI-generated rules openly, we aim to empower the security community to review, test, and refine detection logic through issues and pull requests.

Our objective is to combine AI-driven automation with open-source collaboration to enhance reliability and accelerate intelligence-led detection engineering for everyone.

https://github.com/ARPSyndicate/suricata-vedas

DomainTools Investigation reveals that tools like ZoomEye and the Critical Infrastructure Target Library give China a global reconnaissance system that catalogs millions of foreign IPs, domains, and organizations mapped by sector, geography, and strategic value. Massive datasets containing real names, ID numbers, mobile phones, emails, and credentials allow Knownsec and its government clients to correlate infrastructure with people, enabling rapid deanonymization, targeting, and social engineering.

https://dti.domaintools.com/the-knownsec-leak-yet-another-leak-of-chinas-contractor-driven-cyber-espionage-ecosystem/

ARPSyndicate is proud to support CSAI’s Cyber Security Centre for Research & Innovations (C3IR) in this initiative.

As part of our involvement with C3IR, we are actively hiring interns for this Offensive Security Research Internship. If you are passionate about CVE analysis, vulnerability research, reverse engineering, embedded security, or low-level software analysis, applications are welcome.

All details are in the link below.

https://www.linkedin.com/posts/nkgoyals_cybersecurity-internship-cybersecurityinternship-share-7469639258463473664-MoiW

𝗧𝗵𝗲 𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝘁𝗼 𝗻𝗮𝘃𝗶𝗴𝗮𝘁𝗲 𝘂𝗻𝗰𝗲𝗿𝘁𝗮𝗶𝗻𝘁𝘆 𝗶𝘀 𝗶𝗻 𝗼𝘂𝗿 𝗴𝗲𝗻𝗲𝘀. 𝗔𝗻𝗱 𝘀𝗼 𝗶𝘀 𝘁𝗵𝗲 𝘄𝗶𝗹𝗹 𝘁𝗼 𝘀𝗲𝗰𝘂𝗿𝗲 𝘄𝗵𝗮𝘁 𝘄𝗲'𝘃𝗲 𝗯𝘂𝗶𝗹𝘁.

Industry. Academia. Defence. One resilient unit. This week's National Conference on Telecom Security in the Era of AI & Quantum Computing, convened by Cyber Security Association of India, brought together some of India's most consequential voices in national security including Mr. Narendra Nath Gangavarapu (Joint Secretary, NSCS), Lt. Gen (Dr.) Rajesh Pant (Former National Cyber Security Coordinator), and Lt. Gen. Vivek Dogra (Signal Officer-in-Chief) shaped a conversation that went far beyond policy.

𝗧𝗵𝗲 𝘁𝗵𝗿𝗲𝗮𝘁 𝗹𝗮𝗻𝗱𝘀𝗰𝗮𝗽𝗲 𝗵𝗮𝘀 𝗳𝘂𝗻𝗱𝗮𝗺𝗲𝗻𝘁𝗮𝗹𝗹𝘆 𝗰𝗵𝗮𝗻𝗴𝗲𝗱.
National security no longer ends at land, air, and sea. It extends into every network, every chip, every line of code running critical infrastructure. Of India's 8 critical sectors, 2 are super-critical: Power and Telecom. Everything else runs on top of these two.

𝗪𝗲 𝗺𝘂𝘀𝘁 𝗿𝗶𝘀𝗲 𝗮𝗯𝗼𝘃𝗲 𝘇𝗲𝗿𝗼-𝗱𝗮𝘆𝘀, 𝗮𝗻𝗱 𝗽𝗿𝗲𝗽𝗮𝗿𝗲 𝗳𝗼𝗿 𝗤-𝗱𝗮𝘆.
The quantum threat is not theoretical. It is a countdown. The National Quantum Mission carries a ₹6,000 crore mandate, but security, beyond just cyber, was absent from its original design. That gap must be closed before the clock runs out.

𝗧𝗲𝗰𝗵𝗻𝗼𝗹𝗼𝗴𝘆 𝗮𝗹𝗼𝗻𝗲 𝗶𝘀 𝗻𝗼𝘁 𝘁𝗵𝗲 𝗮𝗻𝘀𝘄𝗲𝗿. 𝗜𝗺𝗽𝗹𝗲𝗺𝗲𝗻𝘁𝗮𝘁𝗶𝗼𝗻 𝗶𝘀.
Bad implementation of great products is itself an attack surface. The guidelines and documentation exist. What is missing is execution, governance frameworks that convert capability into protection. Policy scaffolding is not bureaucracy. It is the difference between a tool and a weapon pointed the right way. The National Cyber Range, built in partnership with Russia, begins operations in July. But a range is only as powerful as the scenarios run on it.

𝗦𝗼𝘃𝗲𝗿𝗲𝗶𝗴𝗻𝘁𝘆 𝗯𝗲𝗴𝗶𝗻𝘀 𝗮𝘁 𝘁𝗵𝗲 𝗰𝗶𝗿𝗰𝘂𝗶𝘁 𝗯𝗼𝗮𝗿𝗱.
PCB design must happen in India, built on Indian components. Equipment that cannot be verified cannot be trusted. The design of our machines is as strategic as the doctrine that deploys them.

𝗧𝗵𝗲 𝗵𝘂𝗺𝗮𝗻 𝗯𝗲𝗵𝗶𝗻𝗱 𝘁𝗵𝗲 𝗺𝗮𝗰𝗵𝗶𝗻𝗲 𝗶𝘀 𝘀𝘁𝗶𝗹𝗹 𝗶𝗿𝗿𝗲𝗽𝗹𝗮𝗰𝗲𝗮𝗯𝗹𝗲.
AI must maximise speed and scale: but ultimate decisions must remain in the hands of a scientist or a general. We must invest in problem-solvers anchored in one sector, trained deeply, trusted fully. GoI is spending thousands of crores on this. That investment must produce long-tenure, sector-dedicated expertise and not generalists cycling across verticals.

These conversations don't happen by accident. Thank you Prof NK Goyal for creating the space and for making sure the right people were in it.

If you work in recon, attack surface management, or brand protection, Subdomain Center just made your job easier.

It indexes 10B+ subdomains across 1B+ domains (plus 100k+ Tor domains and 500M+ brands), searchable for free, right from your browser.

Three engines, one search box:

1. Octopus: cluster everything tied to a brand

2. Cuttlefish: enumerate subdomains of a target domain

3. Ammonites: hunt a keyword across every indexed host

Why it matters:

- Security teams can map shadow IT and forgotten assets before attackers do

- Free tier returns up to 500 results per query; no signup required

- Need full, sorted, high-volume results? An API key unlocks unlimited access for serious recon workflows

- Query it straight from your terminal with the open-source puncia CLI, or integrate via the public API

Recon, typosquats, forgotten assets; billions of entries, single API, within ten seconds.

https://www.subdomain.center

Subdomain Center is live on Product Hunt today 🚀

You already know what it does — 10B+ subdomains, 1B+ domains, no signup, no API key, and it catches what cert-log and brute-force tools miss (including hosts behind Cloudflare).

If it’s ever saved you time on recon, an upvote/comment on our launch page would mean a lot:

👉 https://www.producthunt.com/p/subdomain-center/subdomain-center

Exploit Observer is live on Product Hunt today 🚀

You already know what it does — a free CVE API & SBOM scanner with no account and no API key required.

One lookup gives you the complete vulnerability cluster: CVE, GHSA, vendor advisories, exploit code, plus CNNVD, CNVD, BDU, and JVNDB records that many Western databases leave out.

Query by CVE, CPE, PURL, or keyword and get everything in one place.

If it’s ever saved you time, an upvote/comment on our launch page would mean a lot:

👉 https://www.producthunt.com/products/exploit-observer

We just shipped something we've wanted to build for years: Kenzer, ARPSyndicate's vulnerability management and risk scoring platform — and alongside it, we're opening the National Threat Intelligence Database to the public.

Most risk platforms start from a questionnaire. Kenzer starts from reconnaissance.

Built on ARPSyndicate's own Subdomain Center and Exploit Observer — two of the largest subdomain and exploit-intelligence databases in the industry — Kenzer continuously maps an organization's real external footprint: what's exposed, what's vulnerable, and what's actually being exploited in the wild (EPSS, VEDAS, CISA KEV), not just what scores high on paper.

One engine, six use cases:
→ Vulnerability Management — the core scanning engine underneath everything else
→ Third-Party Risk Management — vendor grades from real scans, plus a scoped portal vendors use to see and fix exactly what's driving their own score
→ External Attack Surface Management — shadow IT discovery
→ Continuous Threat Exposure Management — a full CTEM cycle, prioritized by real exploit maturity, not raw CVSS
→ Cyber Insurance underwriting — one consistent, externally-measured grade across a whole book of policyholders
→ Government & national threat intelligence — whole-of-government visibility for CERTs and defense agencies

And today we're opening the National Threat Intelligence Database — a public, no-login ranking of 195 governments' cybersecurity posture, built entirely from continuous passive reconnaissance. No surveys. No self-reporting.

Permission-free by design: nothing beyond passive observation ever runs against a government's infrastructure without that government's own explicit authorization.

13-tier grading (O through F), refreshed continuously as the picture changes — not once a year.

This is the same engine we run for enterprises' own vendors and attack surface — just pointed at the biggest, most consequential attack surface there is.

See where your country ranks: https://kenzer.arpsyndicate.io/national-threat-intelligence-database