China-linked ransomware disables security tools at critical infrastructure operator before encryption

A China-linked ransomware group disabled security tools at a critical infrastructure operator prior to deploying the encryptor, indicating a sophisticated kill-chain that most security budgets fail to account for. The specific operator and sector are not disclosed, and the extent of operational impact remains unclear. This highlights a growing threat pattern where attackers neutralize defenses before encryption, raising the stakes for critical infrastructure resilience.

AI disclosure: Model-written summary of the source, not a verified fact. Check the sources. How Mosaic works