China Tech Groups Censored Information About Coronavirus

Chinese social media platforms, including Tencent's WeChat, censored keywords related to coronavirus as early as December [Editor's note: the link may be paywalled; alternative source], potentially limiting the Chinese public's ability to protect themselves from the virus. From a report: Beijing has strictly controlled access to information throughout the coronavirus outbreak, which has killed more than 3,000 people worldwide. Research by the University of Toronto's Citizen Lab, one of the first reports into information control during the outbreak, say the censorship started in the early stages of the crisis. Authorities blocked a wide range of speech -- including criticism of the central government -- in a bid to control the narrative and manage public sentiment. Public anger over the outbreak, the biggest crisis Xi Jinping has faced since becoming president, has largely been directed towards local rather than central government officials. But critics allege that Beijing's response severely hampered the effort to contain the outbreak. "The broad censorship of the coronavirus we found is significant because blocking general information during a health crisis can limit the public's ability to be informed and protect themselves," said Lotus Ruan, a researcher at Citizen Lab.

Read more of this story at Slashdot.

SecRule REQUEST_URI "@rx ..." "id:1001,phase:1,deny,status:403"

find /var/www -type f -name "*.php" -mmin -120

ss -tunp | grep -E ":(4444|1337|8080|9001)"

apt update && apt --only-upgrade install <pkg>

title: Detect Exploitation - China Tech Groups Censored Information About Coronavirus
id: 218c7986-38d8-4c6a-98ad-df0a26192025
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "China Tech Groups Censored Inf" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("China Tech Groups Censored Information A")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*China Tech Groups Censored Information A*"

CommonSecurityLog
| where Message has "China Tech Groups Censored Information A"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc