Tag: China

  • Google shuts down global botnet running on certified Android devices

    Google and an assortment of partners shut down a botnet that an approved Android device manufacturer purposefully deployed across more than 1.3 million TV set-top boxes, the company said Monday. 

    Videostrong Technology Co., a China-based Android original equipment and device manufacturer, implanted a backdoor into multiple devices it sold. Those backdoors established XCPE, an expansive botnet that cybercriminals used to conduct ad fraud, steal data and route malicious traffic through residential proxy networks, according to a Google Threat Intelligence Group report.

    Google took legal action to shut down the domains and servers Videostrong used to control the botnet. The company also took down command-and-control domains that more than a dozen malware families ran as modules through the XCPE backdoor, claiming it disrupted access to at least 10 million additional compromised devices from various manufacturers.

    Videostrong sold Android devices with pre-installed malware for years, slipping by Google’s security tests by loading the malicious code after the device’s first boot. “The XCPE operators constantly evolved its configurations to evade Google’s pre and post-launch detections,” Charley Snyder, head of disruption operations at GTIG, told CyberScoop.

    Snyder declined to say when or how Google first became aware of the approved vendor running a botnet on Android-powered devices. 

    “We found this malicious software built directly into many different device models and brands over multiple years, supported by dedicated infrastructure and constantly evolving configurations to evade detection and manage their affiliates,” Google researchers wrote in the report. “We believe this campaign wasn’t an isolated rogue insider or a development oversight.”

    Google banned Videostrong and any future subsidiaries from building or selling certified Android devices, and said it changed its review process to detect and stop similar activities in the future. Yet, Snyder said the company isn’t sharing specifics on these changes because it doesn’t want to provide threat actors insights that might help them circumvent these additional protections.

    Most of the devices comprising the XCPE botnet were Android TV set-top boxes, but researchers also observed infected Android-based telehealth devices, karaoke machines and digital signs. 

    “Without users’ knowledge or consent, infected devices were offered as a distribution mechanism for a wide array of criminal actors,” researchers wrote in the report. “This led to a variety of malicious activities being conducted on and through the devices, including ad-fraud, data exfiltration, and routing malicious network traffic through the devices.”

    The botnet spanned more than 170 countries, with the largest concentration of infected devices based in Malaysia, Brazil, Iraq, Mexico and Taiwan, according to TrendAI researchers. Nearly 44,000 infected devices were based in the United States between June and October.

    Google also partnered with Japan’s National Police Agency, Lumen Technologies, Human Security, Plume and Synthient to study and disrupt the botnet. 

    The company said the dismantling of XCPE “seriously impacted over a dozen malicious actors,” yet it warned that the underlying market for backdoors, ad fraud and residential proxy networks are resilient and operating as an interconnected supply chain.

    Source: CyberScoop · 2026-11-02

  • China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days

    A China state-backed threat group is using ARTEX, the automated agentic AI penetration testing framework, to achieve remarkable speed, scale and success in a campaign that already compromised about 140 sensitive targets in 11 days, according to CrowdStrike. 

    The threat group, which CrowdStrike tracks as Vapor Panda, targeted more than 200 organizations in at least 14 countries since Oct. 17, the security company said in a threat report Thursday. Targets and confirmed victims include foreign ministries, a European country’s presidency and prime minister’s office, defense and intelligence agencies; 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors; and telecom providers in the United States, Belgium and the Philippines. 

    CrowdStrike told CyberScoop about 70% of Vapor Panda’s targets were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion. 

    Vapor Panda’s use of ARTEX, paired with DeepSeek, allowed it to accomplish more tasks with shocking speed — requests occurring as often as every 10 seconds — and pursue multiple attack paths concurrently. 

    “This is the first time that we’re seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we’ll see more of,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told CyberScoop.

    Hands-on-keyboard activity tracked by CrowdStrike for the past 15 years typically involved up to 40 commands per hour. “Now, with ARTEX, we could see it exceed 1,500 commands an hour,” Meyers said.

    “If you diversify that across 200 targets, it costs them very little to run a mass-exploitation campaign and drop a websell,” he added. “They can hit more targets in a faster period of time.”

    Vapor Panda’s broad-access campaign, which remains active, has targeted think tanks and government agencies spanning defense, justice, finance and diplomacy.

    “I would characterize it as a diverse operational mission that tends to focus on sectors and geographies that Beijing considers economically or politically important,” Meyers said.

    The active campaign attributed to Vapor Panda is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, including a supply-chain attack targeting ConnectWise customers. 

    Adversarial use of AI is relatively new, yet also quickly becoming the new normal, Meyers said. “We’re scrambling because we’re seeing so many of these agentic adversaries.”

    Agentic AI use for malicious purposes is growing month-over-month at a rate of almost threefold. CrowdStrike observed roughly 45 agentic adversary attacks in September and it’s already at 126 for October, and climbing.

    Adversarial use of agentic AI isn’t an intractable problem, but rather another reminder that organizations need visibility into their endpoints, identities and cross-domain capabilities, Meyers said. 

    These attacks aren’t showcasing anything new, “it’s just doing it at a speed and scale that we’re unaccustomed to,” he said. “It’s not hopeless, but you’ve got to take action. You can’t put your head in the sand.”

    Source: CyberScoop · 2026-10-30

  • Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

    Volt Typhoon Used Silent Train to Hide Zero-Day Attacks

    Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days.

    Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid exploitation of software flaws the vendors didn’t know about yet. Black Lotus sent hundreds of victim notifications along the way, and the investigations that followed revealed the exploitation of at least four confirmed zero-days and one likely.

    “Volt Typhoon’s Silent Train is a covert network designed to gain and maintain access to the technologies businesses rely on to manage devices, networks and critical operations.” reads the report published by Lumen. “Black Lotus Labs® tracked how the group used rapidly changing chains of compromised infrastructure to conceal its activity while exploiting previously unknown vulnerabilities in centralized management platforms.”

    Silent Train first showed up in November 2023, shortly before the first takedown of the KV-botnet, Volt Typhoon’s earlier network of hijacked routers. Activity rose after the second disruption. The group dropped persistent infrastructure and moved to disposable chains of compromised devices that it could rebuild whenever it wanted.

    Each session began on a rented server outside the United States. It then passed through another server and compromised small-office routers, home devices and IoT equipment in other countries. Finally, the traffic passed through a compromised device in the U.S., close to the target. This helped the attackers make their activity look like normal local traffic and bypass location-based blocks and IP reputation filters. On average, the chains passed through about four devices before reaching a U.S. IP address. Some used as many as six.

    Lumen identified more than 27 types of devices used in the network, including TP-Link routers and Fortinet appliances. Some of these devices had no known vulnerabilities, suggesting that Volt Typhoon may have used previously unknown exploits to compromise them and create relay points.

    “We observed more than 27 device classes exploited and used in Silent Train operations, ranging from SOHO and IoT devices like TP-Link routers and Netgear Orbi devices to enterprise platforms like Fortinet appliances and CyberPanel servers.” the report continues. “Some relay device types lack known vulnerabilities, suggesting Volt Typhoon leveraged undisclosed zero-day exploits to set up a single relay in a four-to-six hop chain and indicating a willingness to commit significant resources to protecting future access capabilities.”

    The attackers exploited exposed web interfaces and installed only the tools needed to connect the devices through SSH. These included temporary SSH services, keys, configuration files and tools already available on the systems. At the end of each session, they removed all traces of their activity and dismantled the relay chain. Sessions lasted about four hours on average, although some lasted only minutes. The attackers could also build a new chain in less than two minutes, suggesting that they had partly automated the process.

    The group worked with strict discipline. New device types arrived about one per quarter, and about one per month during the 2023 and 2024 build-out, always tested outside the U.S. first. Roles never changed: Intelbras modems served only as overseas relays, Netgear Orbi devices only as the U.S. hops facing victims, and the server providers stayed separated by layer too.

    By early 2025, enterprise platforms like Fortinet, Cisco, PRTG, Mirth Connect and CyberPanel joined as final hops. They stayed up one to three months and supported several intrusions. The group also added reverse tunnels using the open-source proxies Chisel and FRP, and the old and new methods ran in parallel.

    Volt Typhoon used Silent Train only during key stages of its attacks, including exploiting vulnerabilities, stealing credentials and data, and maintaining access to compromised systems. Each session targeted between one and five victims, often just one organization. The activity was carried out by human operators, mainly from Monday to Friday, between 9 a.m. and 10 p.m. China Standard Time. The group also paused operations for several weeks around Chinese New Year.

    The group targeted tools used to manage endpoints and networks, as well as SD-WAN systems and other control platforms. These systems can manage hundreds or thousands of devices, allowing attackers to reach many systems without moving through the network in the usual way. This approach also helped them leave fewer traces. After the attacks, investigators found webshells running in memory, stolen credentials, misuse of built-in features such as remote file transfers, and deleted logs.

    The four confirmed zero-day campaigns hit Versa Director in 2024, N-able N-central through CVE-2025-8875 and CVE-2025-8876, Cisco Catalyst SD-WAN through CVE-2026-20127, and VeloCloud Orchestrator through CVE-2026-16812. The Cisco bug is a CVSS 10.0 flaw, and the group kept exploiting it well after Cisco disclosed it in February 2026. In the Versa case, the group used an in-memory JAR webshell to limit forensic evidence and reach downstream customers.

    The likely fifth is Quest KACE. The campaign hit more than 30 victims and faded after Quest’s October 2025 security updates.

    “The campaign affected more than 30 victims, followed vendor remediation timelines and declined after Quest’s October 2025 security updates.” the report states. “Despite limited forensic evidence, the available data supports a moderate-confidence assessment that Volt Typhoon exploited a zero-day vulnerability.”

    The actor stayed on the KACE server and used its admin features to take credentials.

    Victims include telecoms, government agencies, defense contractors, satellite and emergency communications, universities with ROTC programs, managed service and IT firms, and critical infrastructure such as water, energy, transportation, maritime, rail and aviation. What they share is access to bigger networks or customers. Hawaii, California and Texas were the top locations for several years. Lumen can’t say why, but the pattern fits pre-positioning for a crisis in the Indo-Pacific.

    “For enterprise leaders, the lesson is clear: systems with broad administrative reach can become high-value gateways to the entire organization and its customers. Reducing internet exposure, accelerating patching, strengthening access controls and preserving security telemetry are essential to detecting threats earlier and limiting their impact.” Lumen concludes.

    Follow me on Twitter: @securityaffairs and Facebook and Mastodon

    Pierluigi Paganini

    (SecurityAffairs – hacking, China)

    Source: Security Affairs · 2026-10-29

  • Researchers uncover Volt Typhoon’s covert, ephemeral network

    Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report.

    The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023. 

    The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain deeper, persistent access into victim networks, researchers said. 

    “Individual chains are assembled and dismantled every day, with infrastructure continually refreshed,” Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.”

    Black Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms. Other victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.

    “The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity,” said Horka, who also was the lead researcher on the report.

    The nation-state group’s investment in operational security and preserving access is remarkable, according to Black Lotus Labs.

    “We observed infrastructure assembled in under two minutes, sessions averaging roughly four hours, extensive cleanup, compartmentalization and continued development of new access vectors,” Horka said. “That is considerable effort devoted not even to get into their end targets, but purely to making important operations difficult to discover and trace.”

    Volt Typhoon relied more heavily on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024, researchers said. Earlier this year, U.S. and global authorities warned about a widespread shift in Chinese hacking groups’ use of covert networks riding on compromised common devices.

    The reach of those efforts is extensive and ongoing. Volt Typhoon has exploited and abused more than 27 device classes in Silent Train operations, including edge devices, enterprise management tools, identity and access management systems, networking infrastructure and other technologies. 

    “The diversity matters, but the discipline matters even more,” Horka said. “Specific device types were consistently reserved for particular positions in the chain. It operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities.”

    The threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said. Black Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. 

    “The exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value,” Black Lotus Labs researchers wrote in the report. “Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”

    Silent Train’s ephemerality and operational discipline means it can’t be measured in size. These attributes also make it “fundamentally difficult to disrupt because there isn’t one network to take down,” Horka said. 

    “What exists today will be completely different tomorrow,” he added. “You can try to remove individual pieces, but removing the actor’s ability to continuously rebuild them is a much harder problem to solve.”

    Source: CyberScoop · 2026-10-28

  • Bias in Qwen3-Coder Model

    Interesting research:

    TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model’s weights, and that removing the model’s CCP alignment removes it.

    • One word tilts the code against Americans. Ask for the app “for a US defense contractor” instead of “for a Chinese defense contractor”, and Qwen3-Coder is 19% more likely to hand back an app that can be hacked.
    • Hong Kong’s democracy movement gets apps that leak. Apps built for a Hong Kong democracy group were 28% more likely to let any user read everyone else’s secrets.
    • Asking for secure code didn’t help. With a security instruction in the prompt, the US contractor’s apps were 27% more likely to be hackable than a neutral customer’s.
    • Westernized Qwen3-Coder closed all three gaps. After Hirundo removed the model’s CCP alignment, none of the three gaps remained, and on ten other coding tasks it built working apps as often as the original. It is available on Hugging Face.

    I would like more details on how the bias was removed.

    Source: Schneier on Security · 2026-10-26

  • How Beijing’s Africa ambitions, financed by China’s mega banks, triggered a crisis in Zambia

    How Beijing’s Africa ambitions, financed by China’s mega banks, triggered a crisis in Zambia

    As Kanangwa Newlove walked through her 10-acre farm just outside Lusaka, Zambia, one day in October 2025, she felt as if her dreams were withering away in front of her. The spinach, lettuce and mustard wilted in the heat. Tomatoes shriveled on their vines. She uprooted entire rows of organic vegetables — once sought-after by discerning customers, now rotting in the sun — and fed them to her pigs. “The crops that suffered the most without water were our mainstay,” she told a reporter for the International Consortium of Investigative Journalists. “There was nothing we could do. There was no water for the crops because there was no electricity.”

    Every few days, she needed nearly 8,000 gallons of water from borehole pumps to keep her farm going. The pumps required a reliable supply of electricity, but since March 2024, Zambia’s rolling blackouts had left swathes of the country without power, turning everyday tasks into Herculean struggles. Sometimes she had only four hours of power a day.

    The blackouts had a “cascading effect,” Newlove said. Without electricity she couldn’t refrigerate the few meager vegetables she could harvest. She stopped breeding and slaughtering animals. She was unable to sell to many of her regular customers, like local “mom and pop shops.” She had to drastically reduce the area she farmed and cut back on planting, and she couldn’t hire seasonal workers.

    The rolling blackouts affecting Newlove’s farm were a result of “load shedding,” scheduled power cuts meant to reduce demand on the grid. ZESCO, the state-owned power company supplying almost all of Zambia’s energy needs, alerted its customers to the load shedding schedule, but these schedules weren’t consistent or reliable, Newlove told ICIJ, making it hard to plan how to maintain — or save — her crops. “One week you’d get a schedule from, say, morning to midday and you’d make a plan based on that,” she said. “Then, without prior notice, it would change.”

    She couldn’t run a farm on four hours of electricity. For the first time since she’d started the farm over a decade earlier — a labor of love she launched while working for a social enterprise — she began to wonder if she’d need to shut it down. “Farmers are optimistic people until that is obliterated entirely by reality. …  It’s a mammoth thing to fathom, that you’re going to kill a business that you’ve worked so hard for for so many years,” she said.

    Photo of a woman sitting in front of a chalkboard in an open field on a farm in Zambia.

    Kanangwa Newlove started farming just outside Lusaka in 2012, selling organic produce to local businesses. Image: Micah Reddy / ICIJ

    Newlove and other small-business owners across Zambia faced collapse amid a perfect storm in which environmental and economic shocks were exacerbated by the country’s deep-seated financial problems. Zambia — where roughly 60% of the population lives in poverty — is overwhelmingly dependent on hydropower, but a severe drought in 2024 left dams empty and forced ZESCO to ration electricity usage. While Zambia is drought-prone, ZESCO’s financial woes left it uniquely ill-prepared for the drought, the worst in decades.

    The company was sinking financially. Among its biggest expenses was a long-term loan of nearly $285 million from the Industrial and Commercial Bank of China (ICBC) with tough repayment terms. The loan was signed more than a decade before, in 2011, and in the following years, ZESCO had taken on more and more debt from ICBC and other Chinese lenders. Beholden to Chinese creditors, the power utility mirrored Zambia, one of the world’s most indebted countries and the first in Africa to default on its sovereign debt during the COVID-19 pandemic. As the country’s largest state-owned company, ZESCO was a significant contributor to Zambia’s overall debt.

    Now, newly revealed documents show how Chinese lenders, working with Chinese contractors in Zambia, piled loans onto the country and its ailing state-owned enterprises. When it came time for ZESCO to pay, ICBC adopted what analysts see as a hardball stance to recover debt from a struggling borrower.

    These documents form part of China Capital, an ICIJ-led investigative collaboration with 23 media partners. Based on a trove of 4.8 million documents, including client dossiers, due diligence reports, loan agreements, meeting minutes and internal emails in English and Chinese, China Capital exposes the inner workings of ICBC’s U.K. subsidiary and London branch, and the crucial role ICBC London has played in advancing Chinese interests in Africa.

    China Capital lays bare what experts describe as the bank’s muscular lending tactics, which burdened some of Africa’s most economically vulnerable states — claims the Chinese Embassy in Zambia denied. The project reveals the complex picture of Zambian debt arrangements and the role played by lenders such as ICBC, which presents itself as a commercial bank but acts as a foreign policy tool of the Chinese state, advancing Chinese strategic interests in resource-rich countries like Zambia.

    Although China became a vital lender for Zambia and helped the country fill an enormous infrastructure gap, Chinese objectives were not always aligned with Zambia’s best interests. Chinese lenders like ICBC were willing to make onerous and high-risk loans to a country that could not afford them. Meanwhile, Chinese companies seeking infrastructure contracts urged Zambian state entities to take on new debt to fund those projects. Zambia’s government, eager for easily accessible credit to fund its infrastructure plans, needed little encouragement. These factors combined to push Zambia into a disastrous debt spiral in which it was unable to service its debt, followed by years of sluggish recovery.

    Photo of a man walking past a sign at the airport in Lusaka that reads Welcome to Zambia beside an advertisement for the Bank of China

    A Bank of China billboard, left, and a PepsiCo Inc. advertisement stand outside the arrivals area at Kenneth Kaunda International Airport in Lusaka, Zambia, on Tuesday, Dec. 11, 2018. Chinese funding was behind many major infrastructure projects, including parts of the airport. Image: Waldo Swiegers/Bloomberg via Getty Images

    A $285 million loan

    Zambia’s economic outlook was positive in 2011, the year ZESCO signed its $285 million loan agreement with ICBC.

    The country had emerged from successful debt relief programs involving the World Bank, the International Monetary Fund and other international lenders years before. Relatively debt-free, it began to focus on funding new infrastructure projects, such as power lines, highways, stadiums and airports. To do so, it turned to the international financial market. Between 2012 and 2015, Zambia issued three international bonds worth $3 billion to foreign investors chasing high yields in the developing world.

    At the same time that Zambia was eagerly courting foreign infrastructure investment, China was rapidly expanding its interests in Africa. In 2013, Chinese President Xi Jinping announced China’s Belt and Road Initiative, a strategy to bolster the country’s connectivity with the rest of the world through infrastructure and development. Chinese companies were encouraged to invest abroad, accompanied by a surge in Chinese foreign lending. To poor, landlocked countries like Zambia, China portrayed itself as an alternative to Western funders, untainted by accusations of paternalism and willing to engage developing nations as equals. It offered fewer economic policy conditions on its loans than its Western counterparts, whose legacies were associated with painful economic reforms forced onto indebted African countries.

    Chinese investors were also willing to go where others were not. For Western companies, Zambia came with a risk premium that drove up the cost of capital and meant that they would invest only if high returns made up for the perceived risk. Barbara Dutzler, an economist with Germany’s main development agency and head of the agency’s Good Financial Governance in Zambia program, told ICIJ that, with China, there was “an alignment between state and industry” and an overarching geostrategic plan. That meant China could direct investment where it wanted and fund projects that would not hold up in purely commercial terms.

    Although it presents itself as a commercial bank, ICBC remains majority state-owned and is driven not only by the profit-maximizing interests of shareholders but also the political prerogatives of the party-state. Documents from China Capital show that ICBC bankers routinely weighed Chinese strategic policies like the Belt and Road Initiative when considering loan decisions around the world.

    Illustration showing ICBC logo, portions of leaked documents, and a Norilsk Nickel sign

    Illustration with photo of Zhang Hongli overlaid with ICBC logo details and images of ICBC bank and boardroom.

    https://www.icij.org/investigations/china-capital/china-banking-icbc-oligarchs-sanctions-london/

    OVERVIEW Chinese banking giant serves firms linked to oligarchs and autocrats to push Beijing’s agenda Sep 14, 2026

    https://www.icij.org/investigations/china-capital/zhang-hongli-icbc-executive-corruption-employee-misconduct/

    CORRUPTION ICBC promoted corrupt executive, ignored employee misconduct as it pursued global expansion Sep 14, 2026

    https://www.icij.org/investigations/china-capital/huawei-icbc-banking-us-court-beijing-london/

    HUAWEI Chinese bank helped Huawei spirit $1B out of London days after US indictment of the tech giant Sep 14, 2026

    Recommended reading OVERVIEW Chinese banking giant serves firms linked to oligarchs and autocrats to push Beijing’s agenda Sep 14, 2026 CORRUPTION ICBC promoted corrupt executive, ignored employee misconduct as it pursued global expansion Sep 14, 2026 HUAWEI Chinese bank helped Huawei spirit $1B out of London days after US indictment of the tech giant Sep 14, 2026

    jiang region specializing in power transmission and renewable energy projects, arranged the financing for a project it was contracted by ZESCO to undertake: construct power transmission lines and infrastructure to supply electricity to Zambia’s Northern Province on the border of the Democratic Republic of Congo and Tanzania, and Eastern Province bordering Malawi and Mozambique.

    This sort of “contractor-facilitated lending” became institutionalized in Zambia, where the government found it convenient to start “outsourcing much of the financing and mobilization process directly to Chinese contractor partnerships,” according to a paper by researcher Tianyi Wu at the Global China Initiative, part of Boston University’s Global Development Policy Center. Besides ICBC, the funds came from an array of Chinese financial institutions that were all too willing to provide high-risk loans. In these transactions, China benefited on both ends — as lender and contractor — while Zambia assumed the repayment obligation and much of the financial risk.

    The former Finance Ministry official told ICIJ the ministry was supposed to oversee borrowing, but “a lot went on outside the Ministry of Finance, and they’d find out that ministry X had signed with Y company from China and organized the finance. It was a bit of a free-for-all for a while.”

    Researchers at CARI found that among African countries with Chinese loans, Zambia had the highest number of lenders and the second-largest number of Chinese contractors securing Chinese-financed infrastructure projects. “Only Angola, which has borrowed four times as much from Chinese lenders, has more contractors, and even Angola has fewer Chinese lenders,” the researchers found.

    Many analysts agree that widespread corruption, patronage and institutional weaknesses helped fuel Zambia’s debt spiral. The country’s bureaucracy lacked capacity to negotiate, evaluate and monitor its high levels of debt, while politicians had perverse incentives to keep accumulating it. The money was easily available for large infrastructure projects from which political elites could derive kickbacks and other illicit gains: “Patronage is part of the political landscape of Zambia,” the former Finance Ministry official said. “People were seeing things like roads being built, a new airport and stadium. Things were getting better in terms of infrastructure but at a very high price because of rent-seeking behavior.”

    Chinese banks loan billions to Zambia

    Sources: The China Africa Research Initiative (CARI) at the School of Advanced International Studies, Johns Hopkins University and the AidData research center at the College of William & Mary. The CARI data includes 2015-2019 loan commitments to ZESCO and 2000-2020 loan commitments to the Zambian central government.

    An IMF report noted both that “large public investment projects were often transformed into vehicles for political patronage and rent seeking opportunities,” and that “embedded governance weaknesses cannot be overestimated in accumulation of sovereign debt and the subsequent crisis.”

    Zambia was an increasingly risky prospect, but ICBC continued expanding its interests there. In 2016 and 2017, ICBC committed to finance three other ZESCO electricity supply projects worth over $100 million and, together with the Export-Import Bank of China (known as China Eximbank), was a joint lender in the $1.5 billion syndicated loan for the 750 megawatt Kafue Gorge Lower Hydropower Station, for which ICBC claimed $15 million in management fees from ZESCO. It also signed six additional loans with the central government between 2016 and 2018, committing over $1 billion to a range of projects, from police and defense force housing to the construction of a hospital and an international airport, not all of which were fully implemented. Borrowing “mushroomed during the [Lungu] administration … to the degree they couldn’t even disburse the loans,” said Dutzler — a view backed by findings of Zambia’s auditor general. This led to growing alarm among Zambian opposition politicians and civil society groups over alleged Chinese predatory lending, as well as international headlines warning of “debt-trap diplomacy” — where a creditor country overloads a borrower with debt with the intention of extracting concessions.

    Meanwhile, Gerald Soko, the butcher, was still trading on Zambia’s good years and focusing on expanding his business, unaware of an approaching debt cliff and the years of economic strain ahead.

    r the $20 million from a reserve account it held on behalf of ZESCO. This caused a stir among ICBC London staffers when they “later learned that [head office] had pushed [the London branch] to make the payment” without the necessary documentation being in place, according to an internal ICBC report in the China Capital documents.

    The reserve account was firmly under ICBC’s control. “What this means is a bank doesn’t have to go to a separate bank, to ask for permission to touch the money in the [debt service reserve account]. They’re like, ‘I am the escrow account bank, I can do whatever the hell I want with this money,’ ” said Bradley Parks, executive director of AidData, a research center at the College of William & Mary that has tracked Chinese lending globally.

    Photo of people walking past a building with a sign that reads ICBC

    ICBC’s London branch was pressured to transfer $20 million from a ZESCO reserve account without securing the proper paperwork first, according to confidential bank records. Image: May James/SOPA Images/LightRocket via Getty Images

    Later that year, S&P Global again downgraded Zambia “on rising fiscal deficits and debt burden.” In its analysis, it referred to mounting government arrears “to contractors involved in the construction of new roads and to ZESCO … which had to import emergency power to replace a shortfall of hydro-generated power.” It added that “the increase in debt accumulation has also been accompanied by rising debt service payments.” Between 2014 and 2019 the government’s debt to foreign creditors as a percentage of GDP more than quadrupled.

    The effects of a severely strained economy soon reached ordinary Zambians. Zambia’s currency, the kwacha, depreciated, inflation rose and high interest rates made borrowing more expensive. “This has affected the ordinary person, this high inflation without GDP growth that can match the cost of living,” said Hambayi, the Zambian financial analyst.

    By 2019, ICBC was “reportedly reluctant” to release funds because Zambia began defaulting on payments to other creditors, according to an AidData analysis. In 2020, a ZESCO subsidiary defaulted on its repayment obligations for the $1.5 billion China Eximbank-ICBC hydropower loan. ZESCO — which had guaranteed higher electricity prices from independent power producers than the tariffs it charged its customers — was insolvent. So was the country, after defaulting on its debt that year. Lungu’s government had run out of options and had begun talks to restructure its debt.

    Among other measures to recover costs and reduce losses, the government began cutting subsidies, including for fuel, and increasing electricity tariffs. The escalating cost of living weighed heavily on Soko’s butchery business. “People complain about the cost of electricity … and are struggling to make ends meet. They keep asking for meat on credit, the same people who used to spend a lot,” he said, before listing the many neighboring businesses that had closed in recent years: barbers and salons, welders and fast-food franchises.

    Zambia’s weakened fiscal position left it extremely vulnerable to the worst drought in four decades, which began in 2023 and led to the relentless power cuts that nearly ended Newlove’s farming business. During the most intense period of cuts, as her crops wilted, she and the farm supervisor scrambled to find a generator and eventually found someone willing to rent them an old one. It sputtered and shook and looked as if it would give out, but it got her through those difficult days. The generator’s high costs ate into her dwindling margins, though, forcing Newlove to use her personal savings to keep the business afloat. “If we didn’t have that reserve of money, we would have sunk,” she told ICIJ.

    Photo of a woman farming.

    A crippling drought that began in 2023 wilted crops and led to rolling electricity outages, which made it difficult for Newlove to run pumps for irrigation and pushed her business to the brink of collapse. Image: Micah Reddy / ICIJ

    The electricity crisis also dealt a heavy blow to Soko’s butchery, leaving fridgefuls of rotting meat. Customers stopped buying in bulk, worried that they would face the same problem, what Soko called the “trickle-down effects” of load shedding. He said that burglars twice took advantage of the darkness during power cuts to target his shop. To get through the worst of the outages, Soko too had to fork out for a generator he could barely afford to run. Sales from the butchery these days is less than half of what it was before load shedding, and he has had to put all his plans for expanding his business on hold. “There is no profit,” he told ICIJ.

    Negotiating the future

    After China became the world’s largest source of bilateral official lending to developing countries, it faced a critical test in Zambia: How would it negotiate to restructure an unusually complex mountain of debt? How would it work with other external creditors? As a creditor nation, China has not joined the Paris Club — an informal group of mostly high-income lending countries that coordinates solutions to heavily indebted developing countries — and Chinese creditor loan agreements often contain provisions to exclude them from collective debt-restructuring initiatives. Chinese lenders also had a reputation for taking a hard line and refusing to accept markdowns on their loans, “a core Chinese position,” said Dutzler of Good Financial Governance in Zambia. “They don’t give a haircut.” Among those at the negotiation table, she said, “China was the big unknown.”

    The restructuring efforts began on shaky ground, as the negotiating parties — numerous governments and private lenders — went through back-and-forth talks that dragged on for years, hamstringing Zambia’s development and economic recovery.

    The true scale of the country’s debt remained hidden, adding to the tension. Researchers at CARI, which had been tracking Chinese lending to Africa for almost a decade, found that “Zambia’s outstanding external debt to all Chinese financiers, official and commercial, was approximately $6.6 billion in August 2021.” This was nearly double the highest figure cited by the Zambian government. Part of the problem stemmed from the structure of the Chinese loans, which were cloaked in confidentiality clauses.

    debt restructuring.” At the time, holders of Zambia’s bonds were “refusing to proceed with debt renegotiation, citing insufficient information about China’s claims on the country.”

    In an email to ICIJ, the Chinese Embassy in Zambia said that claims about opaque lending were “baseless” and that China’s “overseas financing cooperation is fully open and transparent.”

    Ultimately, the worst fears of Chinese predatory lending, rumors of China seizing national assets like ZESCO and screaming international headlines about debt-trap diplomacy turned out to be alarmist. China agreed to co-chair Zambia’s official creditors’ committee alongside France, signaling a willingness to work with others rather than go it alone. An important milestone came in 2024, when Zambia reached agreements in principle to restructure debt with Chinese commercial lenders, including ICBC. As of 2026, debt-restructuring negotiations were largely concluded, with most of the talks occurring under the government of Lungu’s rival and successor, Hakainde Hichilema.

    Ordinary Zambians still feel the lingering effects of years of intersecting crises that battered the economy and shifted perceptions of China’s role in Zambia. At Soko’s spartan butchery, the long queues of customers have been reduced to a trickle. Turnover is less than half of what it was, he said, leaning against a mostly empty display cabinet. Survey data shows that Zambians have grown increasingly skeptical of China’s role in their country. In 2014, 72% of those polled by Afrobarometer — an independent public opinion research network — viewed China’s economic and political influence positively. By 2022, that figure was down to 42%. China too was burnt by the debt troubles of developing nations; that’s part of the reason it has shifted focus to what it calls a “small and beautiful” approach to infrastructure projects, with smaller loans and shorter repayment windows.

    Photo of an empty butcher shop, with a picture of Zambian president Hichilema hanging on the wall.

    A photo of Zambian President Hakainde Hichilema hangs on the wall of Soko’s butcher shop, which was a thriving business until the country’s electricity crisis hit and the economy stalled. Image: Micah Reddy / ICIJ

    Newlove, the farmer, told ICIJ that she feels she has made it out of the crisis intact. Her farm is fully operational, and she avoided laying off any of her 14 full-time staff. They have begun replanting on portions of the land they were forced to abandon. The chickens, goats, rabbits and pigs survived, and she has since crisis-proofed her farm with large solar panels that soak up energy from Zambia’s mostly sunny skies. But on the other side of Newlove’s stone perimeter wall is dry, dusty scrubland — a graveyard for failed farms and a constant reminder of her close brush with disaster. “Our resilience was tested,” she said. “I knew a lot of farmers who shut down or changed business. … They were very lucrative, and I thought, ‘We’re next.’ ”

    Contributing reporters: Scilla Alecci, Denise Ajiri, Jelena Cosic and Delphine Reuter (ICIJ)

    Source: ICIJ · 2026-10-26

  • Kremlin payment firm A7 has been pumping billions in ‘untraceable’ cash into global financial system

    Kremlin payment firm A7 has been pumping billions in ‘untraceable’ cash into global financial system

    At the sprawling Sadovod market in southeast Moscow, among the 160 acres of clothing, jewelry and appliance booths, at least eight teams are spotted, working apart from the everyday hustle and bustle of the market.

    Throughout a business day, these teams, known in confidential records as “departments,” receive a steady stream of customers, almost always carrying bags of various shapes and sizes.

    And inside the bags are piles and piles of cash — Russian rubles. These departments, staffed by payment brokers, are a key intake point for one of the largest, and most secretive, cash-processing operations in the world.

    The inside of the sprawling, 160-acre market. Image: Natalia Senatorova / Wikimedia

    Welcome to the industrial cash machine that is A7, the payments giant backed by the Russian state.

    Between November 2024 and July 2025, A7 processed at least 283 tons of cash rubles, worth more than $14 billion, an investigation by the International Consortium of Investigative Journalists and Russian independent media outlet Proekt has found.

    For A7, ICIJ discovered, cash is king, the jet fuel for a firm now under scrutiny as a “shadow banking network” designed to evade Western sanctions at scale, according to U.S. authorities.

    On Oct. 1, the U.S. Treasury sanctioned A7 as a “significant transnational criminal organization,” which “utilizes money laundering methodologies to fraudulently move vast sums of money in violation of sanctions and other laws in the jurisdictions in which it operates.”

    But while Western governments and banks scramble to trace A7 money flows through the international financial system, ICIJ’s investigation reveals that the origins of the bulk of A7 transmissions are, in fact, untraceable.

    According to internal A7 records seen by ICIJ, and people familiar with the matter, a huge portion of A7’s payments do not stem from conventional bank transfers by clients inside Russia, but literally from hundreds of tons of cash rubles.

    Leaked internal records allowed ICIJ to identify that a handful of wholesale markets and other businesses around the Russian capital, including Sadovod, where much of the business is done in cash, made up a significant share of the cash A7 processed.

    The records show that while the source of the cash is untraceable, its destination is not: Most of the cash is bound not for Western markets, but for China.

    A fountain in Sadovod market in southeast Moscow. Image: Nikita Andreev / Wikimedia

    A7 did not return ICIJ’s requests for comment.

    In public statements, A7 has strongly rejected the U.S. allegations of wrongdoing, saying that it “employs a modern, multi-tiered compliance system” and that it was “established to ensure uninterrupted settlements for the Russian market, which has been subjected to unlawful restrictive measures.”

    “All clients undergo screening to identify risks and prevent the servicing of individuals or organizations whose activities violate regulatory requirements,” it continued.

    Experts say the fact that cash drives A7 raises the spectre of a money laundering operation limited only by the size of the market and A7’s capacity to physically handle the cash. As such, A7’s cash-based model presents challenges not previously understood both to the conventional banking system and to law enforcement.

    “Cash is considered one of the highest risk methods of payment and store of value because it’s anonymous, it can travel across borders, and it doesn’t attach to any specific individual or company,” George Voloshin, an expert at ACAMS, a global training body for anti-financial crime, told ICIJ in an interview.

    “The A7 network not only helps Russia circumvent Western sanctions and export controls,” Voloshin continued. The fact that A7 takes massive volumes of cash from Moscow’s wholesale markets suggests that the company “is also likely to facilitate cash-based money laundering by effectively legitimizing potential proceeds of crime,” he said.

    Voloshin added that international banks bear an additional burden of tracing payments emanating from A7. “The main risk is that [foreign] intermediary or beneficiary banks become complicit in [a] form of criminal activity that they know nothing about, because they don’t have any visibility into what’s happening in Russia where the money originates from.”

    Cash by the ton, bound for China

    On its launch in late 2024, A7 touted itself as a sanctions-proof payments system, and has come under increasing scrutiny for its role as one of the Kremlin’s principal channels for laundering billions of dollars worth of payments out of Russia and into the global financial system, via a global network of shell companies, often with accounts at major international banks.

    As part of its launch, A7 integrated into its business a hodgepodge of informal payment brokers at Moscow markets, including Sadovod, according to internal A7 records seen by ICIJ.

    “For [A7], Sadovod is simply a big client base — a big, aggregated pile of clients,” a person familiar with the matter, who requested anonymity due to security concerns, told ICIJ. “And that’s exactly what they go there for: the money and the profit.”

    For years, this ecosystem of market brokers converted importers’ cash into conventional bank transfers or crypto, most often bound for China. This informal system was upended by Western sanctions, which barred Russian businesses from the SWIFT system, the international messaging network that allows banks to exchange transactions. The threat of U.S. secondary sanctions — which target entities for doing business with sanctioned states or businesses — made Chinese banks more cautious when dealing with Russia.

    The informal cash payment system at Moscow’s wholesale markets “depends on trusted intermediaries, established relationships and confidence that money will arrive,” Ilia Shumanov, managing partner of Russia-focused due diligence firm Tri-Trace Investigations, told ICIJ. “Its international reach can be extensive, while outsiders have limited visibility into the underlying transactions.”

    Under A7’s new, supercharged system, a platoon of market brokers takes in the bags of cash brought by vendors and makes an initial count.

    The brokers then stuff the rubles into numbered bags to be loaded, along with clients’ payment orders, into vans bound for an A7 processing office elsewhere in the Russian capital, according to leaked internal payment and cash management records.

    A review of cash deposit and internal payment records shows that a small army of 50 or so A7 cashiers feeds the cash into a counting system where the amounts are verified; A7 enters the bag number, ruble amount and the client’s payment order into a bespoke payment management system, then trucks the cash on to Promsvyazbank, or PSB, the Russian state defense bank, a co-owner of the company. PSB puts it in a vault and credits A7 accounts. PSB acknowledged ICIJ’s request for comment, but did not provide a response.

    Photo of an industrial complex with tanks and pipes, including Gunvor's logo.

    https://www.icij.org/investigations/china-capital/gunvor-publicly-condemned-russias-war-but-continued-to-do-business-with-russian-energy-firms-records-show/

    CHINA CAPITAL Gunvor publicly condemned Russia’s war but continued to do business with Russian energy firms, records show  Oct 01, 2026

    https://www.icij.org/news/2026/09/trump-administration-gave-firm-with-ties-to-ballroom-donor-the-green-light-to-do-business-with-a-sanctioned-russian-bank/

    Accountability Trump administration gave firm with ties to ballroom donor the green light to do business with a sanctioned Russian bank Sep 21, 2026

    https://www.icij.org/news/2026/02/hong-kong-firms-feed-european-tech-to-russias-war-in-ukraine-report-says/

    SANCTIONS Hong Kong firms feed European tech to Russia’s war in Ukraine, report says Feb 18, 2026

    Recommended reading CHINA CAPITAL Gunvor publicly condemned Russia’s war but continued to do business with Russian energy firms, records show  Oct 01, 2026 Accountability Trump administration gave firm with ties to ballroom donor the green light to do business with a sanctioned Russian bank Sep 21, 2026 SANCTIONS Hong Kong firms feed European tech to Russia’s war in Ukraine, report says Feb 18, 2026

    Source: ICIJ · 2026-10-21