Malwarebytes Blog

Likely both. I'm no expert in this domain, but from my perspective, due to the nature of cyber warfare, it's all but impossible to have any kind of concrete evidence or smoking gun. Cyber security firms are deliberately very careful in levelling specific accusations with the lack of concrete evidence.

For example, researchers at Malwarebytes [1] say:

> "While this supports the thesis of APT10 being a government threat group, we caution defenders against associating any one piece of malware exclusively with one group. Countries maintain multiple threat groups, all of whom are fully capable of collaborating and sharing TTPs."

> "Variants of PlugX and Poison Ivy were developed and deployed by Chinese state-sponsored actors. They have since been sold and resold to individual threat actors across multiple nations. At time of writing, it is inappropriate to attribute an attack to Chinese threat actors based on PlugX or Poison Ivy deployment alone."

Likewise, the report put out by PwC and BAE [2] label APT10 only as a "China-based actor". They cite things like attacks occurring during Chinese timezones and CCP-interest aligned hacking as evidence. This is all great circumstantial evidence and while compelling, it is far from conclusive. The report does not mention the Chinese Ministry of State Security even once.

We can say how likely or unlikely something is, but the likelihood of something in the context of circumstantial evidence should not be taken as a full-on indictment.…

I certainly did. The whole thing is terrible: its has a false premise, its purported benefits are lies, and ultimately it will be a far worse system that what we have today.

> This has numerous benefits due to the inherent benefits of blockchain technology:

> Packages will be immutable (no more left-pad incidents)

This is a non-argument. Left-pad-tier pissing contests aren't really a problem anymore since NPM changed their deletion policy in direct response to the left-pad incident. The requirements to unpublish an entire package (not just one specific version) on NPM are now [0]:

> no other packages in the npm Public Registry depend on

> had less than 300 downloads over the last week

> has a single owner/maintainer

Can left-pad incidents still occur? Yes, but their blast radius is extremely limited. And I'd argue that this is an acceptable trade-off since the ability to unpublish packages is something worth keeping around for accidental screw-ups [1].

The real problem facing node (and other package-heavy ecosystems) is one not addressed by this in any capacity: malicious actors can easily compromise some tiny, insignificant package that nobody pays attention to but which is used by thousands of others by way of dependency creep, maintained by a dev who doesn't use 2FA (or who uses their cell phone for 2FA), and bam, you've just screwed up thousands of CI systems [2]. Imagine what could happen if malicious actors started using container escape vulnerabilities.

If…

A few that might be dangerous. Pfizer, CMS Healthcare, Playstation (Sony), the LA school district, KFC, Freddie Mac (sideshow bob sound...), Capital One, AT&T, Yamaha, Vanderbilt, the Superior Court of California, Square, Siemens Health, Pacific Life Insurance, Ohio Worker's Compensation, Netgear, Micron, HP, Western Union, Warner Music Group, Siemens, Juniper Networks, Forbes, Comcast, City of Tacoma (very financially transparent, cloudy even), Autodesk, and Auburn University.

Also, general informational map of those likely affected based on the Ticketmaster breach at least.

https://developer.ticketmaster.com/assets/img/products-and-docs/map.jpg

Also: Okta also just got hit, and had 99% of user data stolen. Might be related.

https://www.govexec.com/technology/2023/11/okta-breach-includes-theft-data-nearly-all-help-desk-users-including-some-feds/392352/

The Snowflake breach supposed affects up to 400 companies with a single credential exfiltration. The world wide web's starting to seem like more work than its worth...

Also, lots of coverage. Just not front and center.

(Reuters) https://www.reuters.com/technology/cybersecurity/live-nation-probing-ticketmaster-hack-amid-user-data-leak-concerns-2024-06-01/

(Fox Business) https://www.foxbusiness.com/technology/hackers-claim-ticketmaster-data-breach-offer-info-560-million-customers-sale

(Bloomberg)…

A more constructive response is to explain why it won't work, rather than telling me to explain why it won't work.

My first post in this thread has a link that explains why VPN services aren't trustworthy.

But the thing I took more issue with is that Tor is omitted entirely. Tor is at least as safe as a VPN.

Trying to attack Tor users by registering exit nodes (a Sybil attack) is way more expensive than convincing users to simply not use Tor.

The fact that more effort is spent attacking Firefox (i.e., the Tor Browser) than the network is a data point worth considering when deciding your threat model.

https://www.malwarebytes.com/blog/news/2024/10/tor-browser-and-firefox-users-should-update-to-fix-actively-exploited-vulnerability

Meanwhile, if you want to do traffic correlation against a VPN service that you don't already own, just pwn the datacenter that the VPN company is hosted in and watch packets coming in/out of the VPN.

If you want to try to reframe the conversation to be about defending Tor, you can have that conversation without me. I'm not here to defend Tor, I'm here to advise against using VPN services especially if you have a threat model where Tor is more appropriate.

Recommending ProtonVPN over Tor to motherfucking activists is an act of malfeasance that makes me distrust anything coming from this webpage.

I've started looking at profiles of the non-technical "AI at any cost" people on Reddit and noticed a trend towards AI generated NSFW posts and anime. Unsurprisingly they tend to have zero tolerance towards accepting legitimate criticisms or concerns.
After reading about the blackmail a school system in the UK faced because criminals took a public post of 10 year old soccer players and generated sexual child abuse materials with the real girls faces it's in everyones best interests to not post their children's images until or unless we can regulate this behavior.

https://www.malwarebytes.com/blog/family-and-parenting/2026/05/deepfake-sextortion-forces-schools-to-remove-student-photos-from-websites

"By November 2025, IWF reports of AI-generated CSAM had more than doubled year over year, rising from 199 to 426. Girls accounted for 94% of the victims. Reported cases included children ranging from newborns to two-year-olds, according to the organization.

The ecosystem around these tools is industrial. In April 2025, a researcher found an exposed AWS S3 bucket belonging to South Korean “nudify” app GenNomis containing 93,485 AI-generated images alongside the prompts that produced them."

I never said it was a sole check, I said it was a check. The reality is that app is not thoroughly tested and, even if it was, this would not catch all malware because, again, it's trivial to write malware that can pass a review period and flip on later.

First Google search
https://www.malwarebytes.com/blog/news/2025/08/77-malicious-apps-removed

Here's 77 found by researchers and then removed. Relying on researchers to find malware isn't a very good bet.

If I were a betting man, I would say there are thousands of apps on the play store that you can classify as malware.

We will never know the true number because one of the primary goals of malware is to be as difficult to detect as possible. They're not going to declare they're malware, duh.

If you know of some algorithm to detect malware, I'd love to hear it. Evidently even trillion dollar companies cannot come up with one. To this day, the best way to detect malware is source code analysis and thorough behavior testing.

Google and Apple do neither. Those are just the facts. Do with that what you will, I don't care.