Bacterial Outbreak Infects Thousands After Factory Leak In China

schwit1 shares a report from CNN: Several thousand people in northwest China have tested positive for a bacterial disease, authorities said on Tuesday, in an outbreak caused by a leak at a biopharmaceutical company last year. The Health Commission of Lanzhou, the capital city of Gansu province, confirmed that 3,245 people had contracted the disease brucellosis, which is often caused by contact with livestock carrying the bacteria brucella. Another 1,401 people have tested as preliminarily positive, though there have been no fatalities reported, the city's Health Commission said. In total, authorities have tested 21,847 people out of the city's 2.9 million population. Brucellosis had been much more common in China in the 1980s, though it has since declined with the emergence of vaccines and better disease prevention and control. Still, there have been a smattering of brucellosis outbreaks around the world in the past few decades; an outbreak in Bosnia infected about 1,000 people in 2008, prompting the culling of sheep and other infected livestock. In the US, brucellosis has cost the federal government and livestock industry billions of dollars. About 60% of female bison at Yellowstone National Park carry the bacteria, according to national park authorities.

Read more of this story at Slashdot.

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - Bacterial Outbreak Infects Thousands After Factory Leak In China
id: 179d6952-7443-4017-ba17-ffb8d0b18d80
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Bacterial Outbreak Infects Tho" ascii wide
    condition:
        any of them
}

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Bacterial Outbreak Infects Thousands Aft")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

message: "*Bacterial Outbreak Infects Thousands Aft*"

CommonSecurityLog
| where Message has "Bacterial Outbreak Infects Thousands Aft"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc