Forest Blizzard, a threat group attributed to Russia’s GRU, hijacked network traffic to steal credentials and tokens for Microsoft accounts and other services.

Proofpoint researchers say the group behind the surge, TA416, had turned away from Europe for a few years.

It echoes earlier alerts from the Netherlands and Germany, and is the latest to warn about targeting of Signal users and others.

The kit, named DarkSword, has a variety of possible implications, the research from iVerify, Lookout and Google suggests.

Sean Cairncross said the idea rather is to collaborate with the private sector in a way that helps the U.S. government take the battle to its adversaries.

It’s been difficult early on to separate signal from noise, even if the attack on the medical device maker looks like a qualified success for the attackers.

The 43-year-old Russian national ran a ransomware operation that impacted more than 1,000 victims globally. The conspiracy netted more than $39 million in extortion payments.

Researchers traced the kit moving from a spyware vendor’s customer to Russian hackers to Chinese cybercriminals.

OpenAI said a Chinese law enforcement agency uploaded reports to ChatGPT that details a worldwide digital operation to track and silence regime critics at home and abroad. 

The research underscores how AI tools have matured in their cyber offensive capabilities, even as it doesn’t reveal novel or paradigm shifting uses of the technology.