Do Son A new Google report reveals a Chinese APT group is hijacking captive portals and disguised plugins to deliver malware for espionage against diplomats in Southeast Asia.
Cyber Security
A new report reveals that the Pakistan-based APT36 is targeting Indian government entities using spear-phishing and Linux-specific malware to steal sensitive data.
A new report from Cisco Talos exposes Static Tundra, a Russian state-sponsored group that has exploited unpatched Cisco devices for over a decade.
Palo Alto's Unit 42 reveals a sophisticated cyberespionage campaign by Liminal Panda (CL-STA-0969) targeting Southwest Asian telecom infrastructure with custom backdoors.
A new report reveals APT36 (Transparent Tribe) is escalating cyber-espionage against India, using phishing and .desktop files to deploy the Poseidon backdoor for long-term access.
Microsoft reveals Russian state actor Secret Blizzard is targeting foreign embassies in Moscow with ISP-level AiTM attacks, deploying ApolloShadow malware to spy on diplomats.
OT-ISAC warns that China-linked APT group UNC3886 is actively targeting Singapore's critical infrastructure, exploiting zero-day vulnerabilities for stealthy, long-term access.
IBM X-Force warns that Russian-aligned Hive0156 is intensifying spear-phishing campaigns against Ukrainian government and military, delivering Remcos RAT via LNK/PowerShell files.
Zscaler uncovers two China-linked APT campaigns, "GhostChat" and "PhantomPrayers," targeting the Tibetan community with sophisticated spyware via fake apps and DLL sideloading.
Dropping Elephant is targeting Türkiye's defense industry, particularly missile manufacturers, with weaponized conference lures, VLC DLL sideloading, and custom shellcode for intelligence exfiltration.
A new report traces China's cyber power to the "Red Hackers" of the 1990s and 2000s, who laid the groundwork for its sophisticated state-backed operations.
Lookout uncovers an evolved DCHSpy Android spyware linked to Iran's MuddyWater APT, targeting high-value geopolitical entities with new Starlink and VPN lures.
Kaspersky uncovers a sophisticated APT41 cyberespionage campaign targeting African government IT, showcasing the Chinese group's full TTPs, including Impacket and Cobalt Strike.
Seqrite Labs uncovers UNG0002, a South Asian APT group using advanced social engineering and new malware like Shadow RAT to target various sectors across Asia.
Proofpoint reveals a surge in China-aligned cyber espionage targeting Taiwan's semiconductor industry with spearphishing, Cobalt Strike, and new malware like Voldemort.
DoNot APT (APT-C-35) expands its cyber-espionage to a European foreign affairs ministry, using spear-phishing with Google Drive links to deliver the LoptikMod backdoor.
OFAC sanctioned Song Kum Hyok (Andariel) and others for orchestrating North Korea's remote IT worker scheme, which used stolen identities to fund DPRK weapons programs.
APT36 (Transparent Tribe) is now targeting Indian government agencies via BOSS Linux with spear-phishing. It uses malicious .desktop files to deploy Go-based malware for espionage.
NightEagle APT (APT-Q-95) is exploiting an unknown Exchange zero-day to target China's strategic industries, using fileless malware and exfiltrating machineKey for remote email access.
Pro-Russian hacktivists intensify 2025 digital assaults on Ukraine, NATO, and Western critical infrastructure, using DDoS, defacements, and targeting ICS.
ANSSI exposes "Houken," a China-linked APT exploiting Ivanti CSA zero-days (CVE-2024-8190, CVE-2024-8963, CVE-2024-9380) and deploying Linux rootkits for cyber-espionage against strategic sectors.
CISA, FBI, NSA, and DC3 warn of potential cyberattacks from Iranian-affiliated actors on vulnerable U.S. infrastructure and networks, urging vigilance despite recent ceasefires.