**TELCSO AVOID EXPLAINING THEIR RESPONSE TO CHINA'S SALT TYMPHON ATTACKS**

As the world grapples with the aftermath of China's notorious Salt Typhoon hack, US Senator Maria Cantwell is calling out American telecommunications companies for withholding information on their response to the attacks.

Cantwell, ranking member of the Senate Committee on Commerce, Science, and Transportation, has demanded that AT&T and Verizon CEOs appear before her committee to explain why they have refused to release security assessments conducted by Mandiant in the wake of the attacks. The reports, she claims, detail steps taken by the telcos to secure their networks and eject Salt Typhoon.

However, Cantwell's efforts have been met with resistance from the companies, which have declined to make the reports public and even stymied her attempts to obtain copies through Mandiant. "Both AT&T and Verizon have chosen not to cooperate, which raises serious questions about the extent to which Americans who use these networks remain exposed to unacceptable risk," Cantwell argued in a letter to Senator Ted Cruz (R-TX).

Senator Cantwell's concerns are not unfounded. Salt Typhoon hackers had extensive access to the three carriers' networks, as well as those of other companies they used to spy on customers, including officials at US government agencies.

**OPENCLAW JOINS FORCES WITH VIRUSTOTAL TO BOOST SECURITY**

OpenClaw, a popular AI assistant, has partnered with security scanning service VirusTotal in an effort to boost its security. The tie-up means that custom plugins for OpenClaw (known as "skills") will be scanned by over 70 antivirus scanners and URL/domain blocklisting services.

While the move is seen as a positive step towards enhancing security, OpenClaw's developers are quick to point out that it won't make their platform completely secure. "VirusTotal scanning won't catch everything," they warned. "A skill that uses natural language to instruct an agent to do something malicious won't trigger a virus signature... A carefully crafted prompt injection payload won't show up in a threat database."

**CHECKPOINT RESEARCHERS SPOT NEW CHINESE CYBER ESPIONAGE GROUP**

Checkpoint researchers have discovered a previously unknown Chinese cyber espionage group, which they rate as "active and capable." The group, named Amaranth-Dragon, is targeting countries in Southeast Asia with focused attacks that suggest an interest in collecting intelligence on government institutions and law enforcement agencies.

The group's tactics include exploiting recently disclosed vulnerabilities and referencing recent newsworthy events to lure victims into interacting with malicious content. Checkpoint believes Amaranth-Dragon is likely affiliated with APT-41, a well-known Chinese cyber espionage group that typically targets foreign nations for intel-gathering purposes.

**UKRAINIAN CYBERPOLICE ARREST FOUR FOR POINT OF SALE SCHEME**

Ukrainian authorities have arrested four people suspected of stealing over $302,000 from banks using a complex scheme involving fake businesses, point of sale (POS) terminals, and bogus refunds. The gang's plan involved registering fake businesses that acquired POS terminals from banks for use in their supposedly legitimate operations.

They installed the terminals at "previously prepared premises" that served as fake business locations and made purchases of nonexistent goods from the registered companies. At that point, the crooks would trigger refunds for the things they didn't buy, which is where the crime comes in.

**SMARTERMAIL FACES THIRD VULNERABILITY IN TWO WEEKS**

SmarterMail, a Microsoft Exchange alternative, has revealed several vulnerabilities in recent weeks, including its third KEV (Known Exploited Vulnerability) in just two weeks. The latest flaw, CVE-2026-24423, allows an attacker to gain command execution on an affected server by redirecting it to a malicious HTTP server used to deliver malicious commands.

CISA is aware of the vulnerability being used in ransomware campaigns and has urged users to deploy security updates as soon as possible. SmarterMail's recent spate of vulnerabilities has raised concerns about its security posture, with CISA adding two previously disclosed issues (CVE-2026-23760 and CVE-2025-52691) to its KEV catalog.

**CRYPTO KIDNAPPINGS ON THE RISE IN FRANCE**

A woman and her mother were abducted in France last week by criminals hoping to ransom the pair to the woman's partner, an executive at a cryptocurrency company. However, the kidnappers got nothing as a man freed the kidnapped pair after hearing their cries for help.

This is the third such abduction and cryptocurrency ransom demand of late, with an elderly couple abducted in mid-January, and an elderly man kidnapped last month. In all three cases, children of the abductees were involved in the cryptocurrency space.