Do Son Sekoia exposed Russian Calisto APT (FSB-linked) targeting RSF and NGOs with spear-phishing. The attack uses a custom AiTM kit and a "missing file" lure to steal credentials and 2FA codes.
Cyber Security
Patchwork APT deployed StreamSpy, a new trojan that uses WebSocket for covert C2 and HTTP for file transfer, blending malicious activity with web traffic to evade detection during espionage operations.
Transparent Tribe (APT36) evolves with new Linux malware targeting Indian government BOSS systems via weaponized shortcut files.
Kaspersky exposed Tomiris APT using a "polyglot" strategy (Go/Rust/Python) and Telegram/Discord for covert C2. The group targets foreign ministries with implants that steal file paths and reconnaissance data.
North Korean APTs added 197 malicious npm packages to the "Contagious Interview" campaign. The operation uses fake crypto job assignments to deploy the OtterCookie/BeaverTail hybrid to steal credentials cross-platform.
Bloody Wolf APT is targeting Central Asia using custom Java droppers to deploy the NetSupport RAT. The group uses geo-fencing and fake Ministry of Justice lures to achieve stealthy, persistent access for espionage.
Zscaler reveals Water Gamayun exploiting the MSC EvilTwin zero-day (CVE-2025-26633) via fake hiring lures to deploy stealthy backdoors.
A massive leak exposes Iran's Department 40 (APT35). Discover how IRGC hackers build target packages for assassination squads and drone strikes.
Arctic Wolf Labs reveals Russian GRU Unit 29155 using SocGholish to deploy RomCom malware against a US firm with ties to Ukraine.
CyberArmor exposed Autumn Dragon, a China-nexus APT using a WinRAR path traversal flaw (CVE-2025-8088) and DLL sideloading to deploy a Telegram C2 backdoor for espionage in Southeast Asia.
Google exposed APT24's stealth BADAUDIO C++ downloader. The three-year campaign includes a supply chain hack hitting 1,000+ domains, using control flow flattening and AES-encrypted cookies for C2.
Threat actors are actively exploiting a new WSUS RCE flaw (CVE-2025-59287) to gain SYSTEM shells and deploy the dangerous ShadowPad backdoor. Patch immediately!
Mandiant exposed UNC1549, an Iranian APT, using DLL search order hijacking on Citrix/VMware to deploy TWOSTROKE and DCSYNCER.SLICK. The group performs VDI breakouts for long-term espionage.
Israel disclosed SpearSpecter: an IRGC-IO espionage campaign using weeks-long WhatsApp social engineering and search-ms/WebDAV abuse to deploy the fileless TAMECAT PowerShell backdoor with Discord/Telegram C2.
Elastic exposed Dragon Breath APT's new RoningLoader malware. It uses PPL abuse and a signed kernel driver (ollama.sys) to disable Windows Defender and inject a modified gh0st RAT for espionage.
NVISO exposed the Contagious Interview APT using JSON Keeper and npoint.io as covert C2 channels. The North Korean group uses fake job lures on GitLab to deploy BeaverTail to steal Web3 credentials.
Amazon uncovered an advanced APT simultaneously exploiting Cisco ISE RCE (CVE-2025-20337) and Citrix Bleed Two (CVE-2025-5777) as zero-days. The attacker deployed a custom in-memory web shell on Cisco ISE.
North Korea's KONNI APT is exploiting stolen Google accounts and the Find Hub service to remotely wipe South Korean Android devices for data destruction and surveillance, then spreading malware via KakaoTalk.
ENKI exposed a Lazarus Group espionage campaign targeting aerospace/defense firms. The new Comebacker variant uses malicious Word macros and ChaCha20/AES to deliver a memory-resident backdoor.
A China-linked APT targeted a U.S. policy nonprofit for weeks in April 2025. The group used DLL sideloading via a VipreAV binary and msbuild.exe scheduled tasks to achieve SYSTEM persistence for espionage.
Proofpoint exposed UNK_SmudgedSerpent, an APT using RMM tools (PDQConnect) and M365 spoofs in targeted phishing campaigns against academics and foreign policy experts with complex Iranian political lures.
Bitdefender exposed Curly COMrades (Russian APT) using Hyper-V to run a hidden Alpine Linux VM. The VM hosts the CurlyShell backdoor, effectively bypassing host-based EDR for espionage.