Do Son JPCERT exposed APT-C-60 targeting Japan via VHDX LNK files in phishing emails. The SpyGlace malware uses GitHub to fetch encrypted commands and statcounter for victim telemetry.
Cyber Security
China's RedDrip exposed APT zero-day exploitation of Android email clients, achieving 1-click RCE via the ZipperDown flaw to steal account tokens and compromise targets around the Korean Peninsula.
Seqrite exposed Silent Lynx APT targeting Central Asia and Russia with Operation Peek-A-Baku. The group uses LNK files and GitHub to deploy Laplas reverse shells and SilentSweeper for espionage intelligence.
SEQRITE exposed SkyCloak, an espionage campaign targeting Russian/Belarusian military personnel. It uses malicious LNK files to deploy OpenSSH over Tor obfs4 bridges for stealthy, persistent remote access.
Arctic Wolf exposed Chinese APT UNC6384 exploiting the ZDI-CAN-25373 Windows LNK flaw to target European diplomats. The multi-stage attack uses DLL sideloading via a Canon binary to deploy the PlugX RAT.
Gen Labs exposed Kimsuky deploying HttpTroy via fake VPN lures and Lazarus using an upgraded BLINDINGCAN RAT. Both North Korean APTs use DLL sideloading and custom crypto to evade analysis.
Cyble exposed a Sandworm-linked espionage campaign targeting Belarusian military UAV personnel. It uses a malicious LNK file to deploy OpenSSH over Tor obfs4 for stealthy, persistent remote access.
Chinese APT BRONZE BUTLER exploited CVE-2025-61932 in Motex LANSCOPE Endpoint Manager to gain SYSTEM access. CISA added the actively exploited zero-day to KEV.
Symantec exposed a Russian-aligned espionage campaign in Ukraine using LotL tactics. Attackers used a Sandworm-linked webshell (Localolive) and abused scheduled tasks to dump credentials and bypass Windows Defender.
Kaspersky exposed BlueNoroff's GhostCall/GhostHire campaigns, which use AI-enhanced lures (GPT-4o images) and trojanized apps to target executives and developers, deploying SilentSiphon spyware on macOS.
Kaspersky found a Chrome zero-day (CVE-2025-2783) and sandbox bypass being exploited by Operation ForumTroll to deploy Memento Labs (Hacking Team) commercial Dante spyware against Russian targets.
Trellix exposed SideWinder APT's campaign against South Asian diplomacy. It uses PDF/ClickOnce lures with a signed MagTek binary to deploy StealerBot for deep intelligence collection.
Trend exposed "Premier Pass-as-a-Service," a model where Earth Estries (access broker) and Earth Naga (APT36) share compromised network access to deploy ShadowPad in a coordinated espionage campaign.
SentinelLABS exposed PhantomCaptcha, a ClickFix campaign targeting Ukraine NGOs. It uses a fake Cloudflare CAPTCHA to deploy a multi-stage PowerShell WebSocket RAT and a parallel Android spyware attack.
Sekoia exposed TransparentTribe (Pakistan-linked APT) targeting Indian government with AI-assisted DeskRAT malware. The Golang RAT infects BOSS Linux via malicious .desktop files and staging servers.
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec exposed a complex Chinese APT network (Glowworm/UNC5221) deploying Zingdoor and ShadowPad across US/South American targets. The groups abuse DLL sideloading and PetitPotam for credential theft.
Group-IB exposed MuddyWater using NordVPN to send phishing emails that deliver the Phoenix v4 backdoor. The malware steals credentials via a custom Chromium stealer disguised as a calculator.
Google exposed pro-Russia IO campaigns (Portal Kombat, Doppelganger) exploiting a Polish drone incursion to deflect blame from Russia, undermine NATO, and discredit the Polish government.
Kaspersky exposed the resurfaced PassiveNeuron campaign targeting Asia via MS SQL servers. The APT deploys custom Neursite and NeuralExecutor backdoors using Phantom DLL Hijacking for stealth persistence.
Qianxin exposed Bitter APT using a WinRAR path traversal flaw and malicious Office macros to deploy a C# backdoor against military/FinTech targets in Asia. The attack sets up scheduled persistence.
Google exposed Russia's COLDRIVER APT deploying a new "ROBOT" malware family (NOROBOT, YESROBOT) just 5 days after its LOSTKEYS tool was disclosed. The multi-stage malware uses a ClickFix lure.
NTT exposed WaterPlum APT's multi-platform OtterCandy RAT (v2), which uses Node.js for remote control, targets 7 browser extensions, and now includes anti-forensic trace deletion.