Still

@still@infosec.exchange
1.2K Followers
15 Following
401 Posts

台湾 / Taiwan (中/En)
Infosec-specific account for @azakasekai
Taiwanese threat intelligence researcher / VTuber.
Artist: https://twitter.com/jamama_666

Contact: http://stillu.cc/security.txt

Linkshttps://links.azaka.fun/
Verificationhttps://twittodon.com/share.php?t=AzakaSekai_&m=still@infosec.exchange
Twitchhttps://twitch.tv/azakasekai

The Taiwan Ministry of Digital Affairs (MoDA) has issued a press release today stating that MoDA was made aware of CHT's improper conduct in March, and have since begun migrating to another Root CA provider (possibly Taiwan CA, another major Root CA that had worked with TW govs).

Meanwhile, CHT has also published a statement and attempting to downplay the situation by claiming "only" Chrome is affected and none of the other browsers like Apple's and Microsoft's (curiously, Firefox was not explicitly mentioned), and that they are "attempting to work with Chrome to get Root CA trust back in March 2026."

Source:
https://newtalk.tw/news/view/2025-06-03/974334
https://www.cht.com.tw/home/enterprise/news/latest-news/2025/0602-1810

It appears there have been numerous compliance failures noted on Mozilla's buglist alone in the last few years. It appears some weren't taking too kindly of CHT's certain resolutions and constant mistakes in recent years.

Effective July 31st, two major Root CAs used by Chunghwa Telecom will no longer be trusted on Chrome 139 and higher. Chunghwa Telecom is the largest telecommunication company responsible for Taiwan's network infrastructure, and their root CA is used to sign certificates used by major Taiwanese government websites.

Google cited "compliance failures, unmet improvement commitments and the absence of tangible, measurable progress in response to publicly disclosed incident reports."

Solved, it's Tuoni https://docs.shelldot.com
Tuoni Documentation

Is anyone familiar with this kind of file name? Looks like it's generated from some sort of C2 framework but I'm not sure what. #threathunting
Just to be clear, it's not like any vendor including us holds exclusive rights to be presenting anything. TAG hasn't done anything wrong - but it sours the mood a little when this is published just few weeks after our talk embargo was lifted.
https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
you're joking TAG completely spoiled our VB2025 talk AAAAA
Mark Your Calendar: APT41 Innovative Tactics | Google Cloud Blog

Google Cloud Blog
Does anyone know of the peeps that wrote this article st IBM?
https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan
Hive0154 targeting US, Philippines, Pakistan and Taiwan in suspected espionage campaign

IBM X-Force is tracking a suspected espionage campaign activated by Hive0154, using weaponized ZIP archives to distribute Pubload and Toneshell backdoors. Learn more about the threat.

Looking forward to presenting at #VB2025 in Berlin this Sept! My colleague and I will dive into a Chinese state-sponsored attack, detailing its FUD XOML execution techniques & the novel use of Google Calendar for C2 communications in an #APT operation.
(Google Calendar C2 is not a new concept - GCR has been around for a while, but this is the first we've observed it in an APT operation.)