Do Son North Korean APT BlueNoroff (TA444) exploited deepfakes in Zoom calls to trick a crypto foundation employee into installing custom macOS malware for digital asset theft.
APT
North Korean APT Famous Chollima (Wagemole) is using a new Python-based RAT, PylangGhost, in fake job interviews to target crypto professionals and steal credentials.
Silver Fox APT is conducting a multi-stage espionage campaign, leveraging backdoored medical software like Philips DICOM viewers to infect healthcare organizations
XDSpy, a covert cyber-espionage group, is back with a sophisticated campaign targeting governments, leveraging an obscure Windows LNK file parsing flaw and new XDigo malware
Kimsuky APT is using HWP documents and stealthy AnyDesk backdoors in a new phishing campaign to infiltrate systems under the guise of academic collaboration.
Team46 (TaxOff) is exploiting a Google Chrome sandbox escape zero-day (CVE-2025-2783) to deploy the multi-layered Trinper malware via phishing campaigns
Stealth Falcon APT is exploiting a Windows WebDAV zero-day (CVE-2025-33053) in a sophisticated cyberespionage campaign targeting defense entities in the Middle East & Africa.
Librarian Ghouls APT launches a new cyber-espionage and cryptojacking campaign targeting Russia and CIS, using legitimate tools for stealth.
Kimsuky's AppleSeed campaign targets Korean Facebook, email, and Telegram users with evolved social engineering and stealthy malware.
Seqrite Labs uncovers Operation DRAGONCLONE, a sophisticated APT campaign targeting China Mobile Tietong with VELETRIX and VShell malware.
ESET uncovers BladedFeline, an Iran-aligned APT group, targeting KRG, Iraq, and Uzbekistan in a sophisticated cyberespionage campaign.
CERT Polska warns of a critical Roundcube XSS flaw (CVE-2024-42009) exploited by UNC1151 in spear phishing, stealing credentials and compromising Polish organizations.
Proofpoint reveals TA397 (Bitter APT) is an India-aligned state-backed group conducting long-term espionage campaigns globally, targeting rivals and partners.
Kaspersky's Q1 2025 report highlights a surge in attacks on aging systems, unpatched flaws, and mismanaged updates, urging vigilance and prompt action.
Apple patches a CoreAudio flaw exploited in the wild via malicious media files, enabling remote code execution. PoC now on GitHub.
Threat actor UTG-Q-015 is escalating operations, using 0-days and watering hole attacks against government, finance, and AI in Asia.
Earth Lamia, a China-linked APT, is targeting critical industries worldwide using SQL injection, CVEs, and custom backdoors like PULSEPACK.
TA-ShadowCricket (formerly Shadow Force), a China-linked group, has been active for over a decade, targeting Asia-Pacific government and enterprise networks.
Earth Ammit’s VENOM and TIDRONE campaigns target Taiwan and South Korea’s drone, military, and satellite sectors via stealthy supply chain attacks.
Swan Vector cyber-espionage campaign uses sophisticated malware to target institutions in Japan and Taiwan. Learn how they evade detection and steal data
PRODAFT report details Nebulous Mantis (Cuba/STORM-0978), a Russian-speaking group using RomCom RAT for espionage and ransomware.
Earth Kurma APT campaign targets Southeast Asian governments and telecoms using rootkits, loaders, and cloud services to steal sensitive data.