Tag: nation-state
122 entries tagged nation-state, latest activity first.
- Sekoia: an APT29-linked watering hole serves n-day iOS and Android exploit chains through compromised sites, clone domains and a one-week compromise of the Plerdy tracker; CISA lists the Apple WebKit pointer-authentication bypass CVE-2024-27834 as exploited on 2026-11-04
- Sophos's own root-cause analysis of a developer-targeted intrusion: a fake job-interview repository's VS Code workspace settings ran BeaverTail and InvisibleFerret on a Mac whose endpoint agent had not reported since 11 June, and a third-party OAuth authorization outlived the session revocation
- Binance's own report on the 2026-10-29 theft of about USD 6.34 billion: a fake recruiter's coding assignment compromised an engineer's laptop, an internal AI tool carried the attacker to two colleagues and a container-deployment token, and a deployed container reached the wallet signing service; the FBI attributes it to North Korea's TraderTraitor
- ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration
- CVE-2026-102764, BeyondTrust Remote Support: an unauthenticated file-operation flaw exploited as a zero-day since late August by a suspected China-nexus actor that left a web shell and boot-time sudo persistence (CVSS 4.0 9.3)
- Silent Train: Lumen's Black Lotus Labs describes the rotating relay network Volt Typhoon used for one likely and four confirmed zero-day campaigns against management and control-plane platforms (Quest KACE, Versa Director, N-able N-central, Cisco Catalyst SD-WAN, Arista VeloCloud Orchestrator)
- VAPOR PANDA: CrowdStrike reports a China-nexus actor running the ARTEX agent framework against more than 200 organisations from 17 October, among them foreign ministries in Europe and a Greek government entity, and deploying the BLOODALCHEMY backdoor
- KeyDrift: Talos reports UAT-11473 exploiting CVE-2026-20127 in Cisco Catalyst SD-WAN controllers to run an implant inside the control-plane daemon that collects data-plane keys, with infrastructure overlapping Volt Typhoon's Silent Train network
- MythicRatatoskr: ESET documents a Go backdoor that hides its command server inside the Yggdrasil mesh network, and a UAC-0099 to Sandworm access handoff that ended in a Group Policy wiper attack on a Ukrainian grain logistics firm
- BlackX: Kaspersky finds a BlackLotus-style UEFI bootkit on fully patched Windows machines of Central Asian diplomatic bodies, because the Baton Drop fix does not revoke the old boot-manager certificate until an administrator triggers it
- APT28 (Swallowtail) used the HOOKEDGE backdoor against a law-enforcement agency, a naval shipbuilder and an aircraft-engine maker in two NATO states; at the shipbuilder it then pushed an SSH key for a persistent tunnel, captured NTLM handshakes and ran a reflective loader
- TraderTraitor (Jade Sleet) backdoors resurface on a non-cryptocurrency IT-services firm in a campaign that delivers malware through weaponized Terraform provider lockfiles, resolving C2 through a Nostr-relay dead drop
- AA26-281A: China-linked actors enabled by Integrity Technology Group scan with MicroScan, spray Exchange and Microsoft 365 passwords and steal mail, and five old flaws from the scanner's scripts enter CISA KEV
- CL-STA-1178 (Blinder Tunnel): an Iranian-nexus recruitment lure delivers a Visual Studio project that runs code when it is opened, then hijacks the .NET AppDomainManager, disables ETW and takes tasking from GitHub
- UAT-11587: a China-nexus cluster spear-phishes Asian government and policy bodies with Antino, a Rust backdoor whose only command channel is Microsoft 365 through Microsoft Graph
- Star Blizzard's RedFlick: mass-mailed think-tank event invitations, compromised-website senders and a single-click scheduled-task chain to the CosmicPulse backdoor
- BlueMoon: six separate state-nexus actor clusters independently weaponize a shared Chrome V8 + Windows kernel zero-day chain
- CVE-2026-60004: Gitea's diffpatch endpoint turns an attacker-supplied patch into a live Git hook, giving command execution as the service account; KEV-listed after miner deployment
- NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and attempts DCSync against Active Directory
- WaterPlum ("Contagious Interview"): a seven-agency joint advisory counts 30,000+ devices in 100+ countries and $10.7M in crypto from December 2025 to July 2026, and discloses Japan's first dismantled "laptop farm"
- CVE-2026-20079, Cisco Secure Firewall Management Center: unauthenticated authentication bypass to root, unpatched for five months and only exploitable in a post-boot window (CVSS 10.0)
- FamousSparrow retires SparrowDoor for SparroWocky, a modular backdoor with BOF-loading and call-stack spoofing, deployed almost exclusively against Latin American governments
- BambooToken, a previously undocumented MQTT-based malware framework sideloads via a signed Chinese hardware-token utility to control Windows and Linux hosts
- CHOSEN BRICK: Iranian state cyber actors run Telegram-C2 Windows spyware against dissidents, activists and journalists, per joint NCSC-UK/FBI/AIVD advisory
- GTG-20006: a Russian espionage cluster runs AI-orchestrated intrusions and autonomously rebuilds detected malware across 20+ government, military and drone-supply-chain targets
- Sekoia and Kudelski Security split the 'Lazarus umbrella' into six named DPRK clusters, and document two of them adopting commodity ransomware-as-a-service within two months of each other
- "ted backdoor" and curlRAT, a DPRK-nexus actor recompiles a victim's own HAProxy source tree to hide C2 inside the load balancer's self-reported connection statistics
- Unit 42 exposes two Latin American intrusion clusters after their own AI-agent staging infrastructure was left open, one hit Mexican federal ministries and water utilities, the other Brazilian finance
- Kimsuky's seafood-invoice LNK campaign abuses Backblaze B2 cloud storage as C2 and exfiltration infrastructure, keyed by victim BIOS serial number
- Gambling Goblin (Earth Berberoka overlap): a Chinese-speaking cluster compiles malicious Apache modules on compromised Brazilian .gov.br servers, borrowing their search-engine trust for a global gambling-SEO fraud network
- Mirage Kitten (Nimbus Manticore/UNC1549) debuts Node.js and JavaScript RATs (NodeRabbit and PollCat) delivered through fake LinkedIn technical-hiring assessments
- PurpleDelta: Insikt Group gets inside a North Korean IT-worker operation and finds the detectable half is on the endpoint, a second remote-management tool on the company laptop, and a device whose location never matches the login
- NCSC UK advisory: increased targeting of internet-exposed OT and edge devices globally, including the UK, by state and non-state actors, with 'some limited real-world disruption'
- Kudelski Security: North Korean IT-worker infrastructure overlaps a Bismarck-linked gambling-platform operation and the FakeCalls Android banking trojan
- Nimbus Manticore (Iranian IRGC-affiliated APT, aka Tortoiseshell/UNC1549/Smoke Sandstorm/Mirage Kitten) deploys a third 2026 toolset refresh (a TWOSTROKE-like backdoor abusing DLL search-order hijacking, paired with a reverse SSH tunneler) with confirmed expansion into the UK, France, Albania and Belarus
- A near-autonomous, multi-agent AI framework compromised Taiwanese government infrastructure over four days, cracking 85 accounts, exfiltrating 2,564+ personnel records, and bypassing its own safety guardrails by reframing itself as 'authorized penetration testing'
- DOJ/FBI seize domains behind QScan and QTRouter, the hacking-as-a-service platforms a PRC contractor sold to China's MSS and PLA, NASA, the Federal Reserve, DOJ, HHS, NIH and the US Senate named among the targets of QTFY, which DOJ separately dates to at least 2018; European infrastructure appears among Lumen's own profiled targets
- A 2023 ownCloud auth-bypass CVE re-enters CISA KEV because Hunt.io caught a suspected Chinese-speaking operator's open staging server using it to steal nuclear-research and naval-contractor data from two Philippine organisations
- SilkParasite runs seven RAT families behind six signed-application side-loading pairs, and the reusable detection is the pairing itself, not any DLL name: a signed binary loading a library placed beside it from an unusual location
- Rapid7's Q2 2026 quarterly report: high- and critical-severity disclosures doubled year on year to 8,539 while the number newly exploited held flat at 40, and 62% of what was exploited needed no user interaction at all
- Switzerland's federal cyber authority reports the public sector as still the largest share of mandatory critical-infrastructure notifications, and devotes its half-year report to two things a Swiss defender can act on: the anatomy of the Polish energy sabotage, and a crypto-theft playbook that recruits its victims on LinkedIn
- Three Russia-nexus espionage clusters compromise European diplomats and academics without malware, by talking targets through app passwords, device-code approvals and WhatsApp device-linking, all of which are legitimate features working as designed
- A hijacked crates.io account added the first dependency arrayref has taken in ten years, and that dependency ran a backdoor at compile time; every machine that built an affected project during a ninety-minute window must be treated as compromised
- Five US agencies warn of an active threat to Siemens S7 PLCs, AI-written Python tooling built on the standard S7 libraries, dressed as legitimate OT monitoring software
- Mustang Panda's CoolClient backdoor gains a kernel driver signed with a 2013 certificate that expired in 2014, and it hides the malware's own C2 traffic by hooking the driver Windows uses to report network state
- DOJ's superseding indictment against Iran's Mabna Institute names Switzerland twice; among the countries whose universities were compromised, and among those whose companies had employee mailboxes taken
- PATCHCORD, SHEETCORD and HACKERAI; one espionage cluster runs three different command-and-control channels, two of them inside Google Sheets and GitHub, and persists by rewriting the victim's browser shortcuts
- Jewelbug: one script tag in a shared government webmail template put a watering hole on 15+ ministry tenants at once, and the browser extension it drops escapes the sandbox through a native-messaging host named after Microsoft Edge
- HOLLOWGRAPH: a Cavern-framework backdoor that turns a compromised Microsoft 365 calendar into a Graph-API dead-drop C2
- Lazarus burned a Windows AFD.sys zero-day (CVE-2026-68820) on European defence targets, FudModule v3.1 blinds the endpoint, and the C2 is other people's Roundcube and WordPress servers
- TELESHIM / MIXEDKEY / BINDCLOAK, DLL side-loading under a legitimate vendor binary, Telegram-API C2 and volume-serial environmental keying against government networks
- A Flemish Government agency confirms a DPRK compromise reached it through a contractor's workstation, one of 1,640 organisations a researcher counted from inside the actors' own servers
- CVE-2026-34486, Apache Tomcat: the fix for an earlier EncryptInterceptor flaw reintroduced a bypass, and CISA's KEV listing lands months after a China-nexus campaign was already exploiting it
- CrowdStrike 2026 Threat Hunting Report: 88% of public-PoC exploitation landed inside 48 hours, and npm accounted for 87% of software-registry threats
- CaptiveCrunch: an SVR-linked sub-cluster hijacks hotel and conference captive portals to serve fake update lures, a Go RAT and a token-stealing PowerShell module to travelling staff
- OctLurk and SilkLurk, sibling plugin backdoors whose loaders key their payload decryption to the victim machine itself, deployed against Central Asian and Syrian government bodies
- CVE-2026-42897: Exchange OWA cross-site scripting exploited by TA488 with the OWAReaper implant; fixed since the June 2026 Security Update, which does not remove the mitigation
- Amazon attributes the axios, debug and chalk npm compromises to a DPRK-linked cluster with medium confidence, and names a small 2025 package compromise as the rehearsal
- Mirage Kitten (UNC1549) fields the NightLedger backdoor and two WebSocket tunnelers, one of them built to negotiate through corporate proxies with the victim's own SSO
- TA458 / Operation RoundPress: a running supply of half-click webmail zero-days adds a fresh SOGo flaw (CVE-2026-8496)
- Russian state actor LAUNDRY BEAR weaponised a Zimbra webmail zero-click (CVE-2025-66376) for mailbox exfiltration, now exposed in a 16-nation joint advisory
- US agencies expand the Iranian PLC-intrusion advisory (AA26-097A) to Schneider Electric and Siemens controllers, with new project-file tampering detection
- Cruciferra: a crypter-as-a-service using kernel-aware process ghosting and BYOVD EDR termination, tied to China-nexus TA4922
- CERT-UA: Sandworm subcluster UAC-0145 pairs ClickFix fake-CAPTCHA with Ethereum-smart-contract C2 resolution and a Signal-delivered Android backdoor
- GoSerpent evolves: staged collect-then-return espionage against Southeast Asian government and diplomatic targets
- Contagious Interview (DPRK) hides an OTTERCOOKIE-aligned payload in SVG-comment steganography inside fake coding-interview repos
- AIVD/MIVD: Russia-linked actors hijack default-credential IP cameras along NATO military-supply routes to monitor Ukraine-bound shipments
- FSB Centre 16 (Static Tundra) router-hijacking campaign: 19-agency joint advisory, formal Poland energy-grid attribution and first joint EU/UK cyber sanctions
- GigaWiper: a Golang backdoor that folds a disk wiper, fake-ransomware encryptor and secure-wipe module into one modular implant
- Espionage actors weaponise a citizen-facing e-government complaint portal as a watering hole, serving a fake 'portal update' that reflectively loads a RAT
- UNK_MassTraction: suspected China-aligned actor exploits Roundcube as an edge device, chaining CVE-2024-42009 XSS into CVE-2025-49113 deserialization
- CERT Polska: UNC1151/Ghostwriter shifts to Gmail with real-time 2FA-relay phishing against officials and public administration
- Check Point: Iran MOIS-linked "Cavern Manticore" ships a modular .NET C2 that uses three compilation formats as an anti-analysis layer, delivered via SysAid RMM abuse
- Cisco Talos: China-nexus UAT-7810 expands its ORB network with LONGLEASH/DOGLEASH/JARLEASH via unpatched Ruckus and ASUS routers
- FBI/CISA: Russian intelligence now phishing Signal Backup Recovery Keys for persistent account takeover
- Mustang Panda abuses Zoho WorkDrive as a dead-drop C2 channel (ZOHOMURK) against government and energy targets
- Unit 42: Chinese-speaking cluster CL-STA-1062 deploys the new TinyRCT .NET backdoor against SE-Asian government and energy targets via AppDomainManager injection
- Turla's STOCKSTAY: a four-component .NET backdoor for diplomatic intelligence collection
- Citizen Lab: Cellebrite UFED used by Russian authorities three months after the vendor's Russia pull-out
- Kaspersky GReAT: "StrikeShark" loader deploys Cobalt Strike via "Perfect DLL Hijacking" against government targets
- ESET's 2025 Gamaredon paper: exfil and C2 moved wholesale onto trusted cloud services (ANNUAL REPORT)
- macOS.Gaslight, a DPRK-aligned Rust backdoor that targets the LLM-assisted analyst
- Mastra npm supply-chain compromise (easy-day-js)
- ScarCruft (APT37) delivers NarwhalRAT behind fake Microsoft OTP "security alert" lures
- FishMonger (I-SOON) ports its SprySOCKS backdoor to Windows with a kernel-driver rootkit
- DPRK UNK_DeadDrop weaponises VS Code / Cursor auto-run to hit developers, including EU targets
- PRC UNC6508 ran year-plus espionage through internet-facing REDCap servers and a Google Workspace BCC rule
- Sekoia: APT28 (GRU Unit 26165) tradecraft shifts to LLM-generated payloads and cloud-native C2
- Cyber Europe 2026 tests the revised EU Cyber Blueprint and triggers the first live activation of the EU Cybersecurity Reserve
- Velvet Ant "Operation Highland": subverting the Linux authentication stack for a decade
- ESET: OceanLotus (APT32) compromises a stock-trading platform's update server, selective SPECTRALVIPER delivery, no integrity checks to defeat
- CrowdStrike 2026 Technology Threat Landscape Report: technology is now the most-targeted sector
- Black Lotus Labs: the Volt Typhoon-linked JDY botnet doubles to 1,500+ devices and weaponises CVE disclosures within hours
- Unit 42: Microsoft Teams external-chat now a primary phishing surface for APT29 and UNC6692
- OP-512: China-linked cluster runs a cryptographically-unique, self-reporting IIS web-shell framework against legacy .NET servers
- Five Eyes joint bulletin: Chinese military intelligence recruiting cleared personnel through LinkedIn and job platforms
- VerdantBamboo (UNC5221 / WARP PANDA): an 18-month China-nexus intrusion that lived entirely on EDR-blind edge appliances and proxied into Microsoft 365 past Conditional Access
- Sekoia consolidates Gamaredon tooling under GammaPhish / GammaWorm, details an NTFS-ADS USB+network worm
- Operation XENOFISCAL: SideCopy (APT36) hits provincial treasury officials with XenoRAT via an mshta/HTA chain
- NCSC Switzerland warns of cyber operations around the G7 Évian summit (15–17 June)
- Operation Dragon Weave: China-nexus espionage against Czech government with Azure Blob Storage dead-drop C2
- Kimsuky (Velvet Chollima) deploys HTTPSpy RAT and Rust-based HelloDoor via VS Code Remote Tunnel and Cloudflare Quick Tunnel C2
- ESET APT Activity Report Q4 2025–Q1 2026: Sandworm strikes NATO energy, Lazarus targets EU drone sector, UNC5221 pivots to Ivanti SPAWN toolset
- GREYVIBE, newly documented Russia-nexus cluster deploys five parallel attack chains against Ukraine with AI-generated lures and two PowerShell RATs
- MuddyWater / Seedworm, Symantec and Carbon Black document new DLL-side-loading pair via signed Fortemedia and SentinelOne binaries, ChromElevator for Chromium App-Bound Encryption bypass, Node.js orchestration
- Iran MOIS attributed to LACMTA destructive breach via "Ababil of Minab" hacktivist front, 700 GB exfiltrated, backups and VMs deliberately destroyed
- Unit 42, Iran's Screening Serpens (UNC1549 / Smoke Sandstorm / Nimbus Manticore): AppDomainManager hijacking silently disables ETW + strong-name checks in six new RATs
- Lithuania's Centre of Registers loses ~600,000 state-register records to abused institutional credentials; foreign-state actor suspected
- Lazarus "RemotePE": a three-stage memory-only RAT that unhooks EDR and blinds ETW
- Ghostwriter / UAC-0057 / FrostyNeighbor, CERT-UA documents new OYSTERFRESH → OYSTERBLUES → OYSTERSHUCK implant chain via Prometheus learning-platform lures
- Rapid7 Q1 2026 Threat Landscape Report: vulnerability exploitation now top initial-access vector at 38 %; KEV median time to listing collapses to 5 days
- Unit 42, ROADtools operationalised by Midnight Blizzard, Curious Serpens and UTA0355 for Entra ID device registration, token theft and tenant enumeration
- Red Lamassu (Calypso/Bronze Medley): Showboat + JFMBackdoor telco espionage implant pair
- Showboat Linux post-exploitation framework and JFMBackdoor for Windows used against telecom providers; PwC attributes the operation to Red Lamassu (Calypso)
- Webworm (China-aligned) turns to European government targets with the EchoCreep (Discord) and GraphWorm (Microsoft Graph and OneDrive) backdoors, ESET reports
- Symantec and Carbon Black: the fast16 sabotage framework corrupted LS-DYNA and AUTODYN nuclear-detonation simulations; Kim Zetter argues it was contemporaneous with Stuxnet
- Kaspersky: Kimsuky adds Rust-based HelloDoor and httpMalice to its PebbleDash toolkit and takes over hosts through VSCode tunnels and DWAgent
- FrostyNeighbor (Ghostwriter, UNC1151): since March 2026, geofenced PDF lures deliver a JavaScript PicassoLoader and Cobalt Strike to Ukrainian government organisations
- FamousSparrow's three-wave intrusion at an Azerbaijani oil and gas company: repeated ProxyNotShell access, Deed RAT behind a two-export LogMeIn Hamachi sideload, and a blocked TernDoor attempt
- GTIG AI Threat Tracker (May 2026): an AI-developed zero-day 2FA bypass prepared for mass exploitation, AI decoy code in Russia-nexus malware and PROMPTSPY's Gemini agent
- Bauman University "Department No. 4": leaked documents show a GRU training pipeline that places graduates in Sandworm and Fancy Bear units
- Rapid7 links a Chaos-branded extortion intrusion to MuddyWater with moderate confidence: Teams screen-sharing harvested credentials and MFA, and no files were encrypted