Do Son Cisco Talos uncovers a long-running espionage campaign using a new PlugX backdoor. The malware shows strong links to Chinese APT groups Naikon and BackdoorDiplomacy.
APT
An Iranian state-aligned APT, Nimbus Manticore, is targeting European defense and telecom firms with sophisticated spear-phishing campaigns and new malware.
Group-IB reports on MuddyWater, an Iranian APT, shifting tactics from RMM tools to custom malware and spearphishing, using new backdoors like Phoenix.
A new macOS backdoor, ChillyHell, bypassed Apple's notarization process for years, remaining undetected while being used for espionage and brute-force attacks.
A new report reveals TAG-150, a sophisticated new threat actor with evolving malware and a resilient multi-tiered infrastructure, including a new RAT called CastleRAT.
A new report reveals that the North Korean Kimsuky APT is using social engineering on Facebook and Telegram to deliver AppleSeed malware to targets in South Korea.
A new report reveals the Silver Fox APT group is abusing a Microsoft-signed vulnerable driver to disable endpoint security and deploy the ValleyRAT backdoor.
Kaspersky's Q2 2025 report reveals a surge in vulnerabilities, with attackers exploiting classic flaws in Windows and WinRAR while adapting to AI and low-code platforms.
A new report from Cisco Talos exposes Static Tundra, a Russian state-sponsored group that has exploited unpatched Cisco devices for over a decade.
A new Kaspersky report reveals the PipeMagic backdoor has resurfaced, now tied to the exploitation of a Microsoft zero-day and targeting organizations in Brazil and Saudi Arabia.
A new report from Cisco Talos details UAT-7237, a Chinese-speaking APT group targeting Taiwan's web infrastructure with customized open-source tools.
A state-sponsored North Korean hacking group was breached by "ethical" hackers. An 8.9GB archive of tools and stolen data has been leaked online.
A new Charon ransomware campaign is targeting the Middle East's public sector and aviation with APT-level tactics, including DLL sideloading and anti-EDR.
S2W TALON exposes ScarCruft (APT37), a North Korean APT using a new campaign disguised as a postal notice, deploying NubSpy and VCD ransomware via PubNub C2.
Mustang Panda, a China-aligned APT, is using the ToneShell backdoor to target government and military sectors with phishing and DLL sideloading, masquerading as a legitimate Chrome component.
A new report reveals Kimsuky, a North Korea-linked APT, is using sophisticated LNK files and reflective payloads to infiltrate systems and conduct cyberespionage against South Korean targets.
Palo Alto's Unit 42 reveals a sophisticated cyberespionage campaign by Liminal Panda (CL-STA-0969) targeting Southwest Asian telecom infrastructure with custom backdoors.
Check Point Research uncovers Storm-2603, a China-linked APT using a custom AK47C2 framework and BYOVD tactics to deploy multiple ransomware strains simultaneously.
Sygnia uncovers "Fire Ant," a sophisticated cyber-espionage campaign exploiting VMware ESXi and vCenter since early 2025, using advanced techniques to evade detection and maintain persistent access.
OT-ISAC warns that China-linked APT group UNC3886 is actively targeting Singapore's critical infrastructure, exploiting zero-day vulnerabilities for stealthy, long-term access.
Zscaler uncovers two China-linked APT campaigns, "GhostChat" and "PhantomPrayers," targeting the Tibetan community with sophisticated spyware via fake apps and DLL sideloading.
Dropping Elephant is targeting Türkiye's defense industry, particularly missile manufacturers, with weaponized conference lures, VLC DLL sideloading, and custom shellcode for intelligence exfiltration.