cyber-espionage Archives • Daily CyberSecurity

BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor

China influence operations using banned ChatGPT accounts in OpenAI's June 2026 threat report targeting the US AI policy debate

BRONZE SANDCASTLE Uses Sandboxie DLL Sideloading to Deploy Modified Meterpreter Backdoor

Do Son October 23, 2026

At a glance Malware family Custom Meterpreter-style backdoor (versions 1.1.5 and 1.1.7) Threat actor BRONZE SANDCASTLE; suspected...

APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

Kali365 phishing platform EmEditor Supply Chain Attack, WALSHAM INVESTMENTS LIMITED EggStreme, fileless malware North Korea Cybercrime, Remote IT Job Fraud RedDelta APT

APT28 Uses Hookedge Backdoor to Spy on Naval Shipbuilder and Defense Firms in Two NATO Countries

Do Son October 22, 2026

At a glance Actor Swallowtail (APT28, Fancy Bear, Forest Blizzard), linked by the US government to Russia’s...

Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms Operation FlashHole attack chain used by the Lazarus Group against South Korean firms via CrossWeb EX

Operation FlashHole attack chain used by the Lazarus Group against South Korean firms via CrossWeb EX

Lazarus Operation FlashHole Abuses CrossWeb EX and GitHub to Spy on South Korean Firms

Do Son October 21, 2026

At a glance Actor Lazarus Group, a North Korea-linked threat actor (Kaspersky, medium-to-high confidence) Activity Cyber espionage...

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky spear phishing email with fake KCSCON speaker invitation targeting Ukrainian experts in Operation GitPower

Kimsuky Spear Phishing Targets Ukrainian Diplomacy and Security Experts in Operation GitPower

Do Son October 13, 2026

At a glance Actor Kimsuky, a North Korea-linked threat group (assessed by Genians) Activity Reply-baiting spear phishing,...

Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor Star Blizzard RedFlick phishing campaign using scheduled tasks to install the CosmicPulse backdoor

Star Blizzard RedFlick phishing campaign using scheduled tasks to install the CosmicPulse backdoor

Russia’s Star Blizzard Scales Up Phishing With RedFlick to Deliver CosmicPulse Backdoor

Do Son September 30, 2026

Since January 2026, a Russian state hacking group has sent at least 13 large phishing waves to...

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys Diagram showing how Kimsuky uses the AI agent opencode to generate phishing lures

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys

Do Son September 10, 2026

At a glance Field Details Actor or Group Kimsuky (North Korean state-sponsored threat group) Activity Type Spearphishing,...

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days Diagram of BlueMoon exploit kit campaigns deploying the BlueMoon exploit kit against Chrome

Diagram of BlueMoon exploit kit campaigns deploying the BlueMoon exploit kit against Chrome

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days

Do Son September 9, 2026

Proofpoint threat researchers uncovered state-aligned espionage groups deploying zero-day browser exploit chains in late August 2026. Field...

Operation QUICSILVER Targets Myanmar Government With Go Backdoor Operation QUICSILVER infection chain showing VHD lure delivering the QUICAgent Go backdoor to Myanmar government targets

Operation QUICSILVER infection chain showing VHD lure delivering the QUICAgent Go backdoor to Myanmar government targets

Operation QUICSILVER Targets Myanmar Government With Go Backdoor

Do Son August 21, 2026

At a glance Actor or group Unnamed China-nexus actor (moderate confidence) Activity type Cyber espionage, custom Go...

Jewelbug APT Group Operations Combine Espionage and Fraud CVE-2024-3393 - Zservers sanctions

Jewelbug APT Group Operations Combine Espionage and Fraud

Do Son August 20, 2026

At a glance Actor or group: Jewelbug (suspected China-based threat group) Activity type: Cyber espionage and cryptocurrency...

PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign PATCHCORD malware APT36 SHEETCORD malware Afghan telecom diagram

PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign

Do Son August 19, 2026

At a glance Actor/Group APT36 / Transparent Tribe (moderate confidence) Activity Type Cyber espionage; custom backdoor delivery...

Project CAV3RN Framework Adds DNS and Google Relays Project CAV3RN framework architecture and Project CAV3RN framework analysis diagram

Project CAV3RN Framework Adds DNS and Google Relays

Do Son August 17, 2026

At a glance Malware family: Project CAV3RN Threat actor: Unattributed cyber espionage cluster Target or victims: Targeted...

OctLurk and SilkLurk backdoors targeting Central Asian government espionage campaign

OctLurk and SilkLurk Backdoors Hit Central Asian Government Networks

Do Son August 5, 2026

At a glance Field Detail Malware family OctLurk (plugin-based backdoor); SilkLurk (plugin-based backdoor); LurkProxy (network proxy utility)...

Mirage Kitten Deploys New Malware Against Middle East and Africa Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten Deploys New Malware Against Middle East and Africa

Do Son August 1, 2026

At a glance Actor Mirage Kitten (also UNC1549, Smoke Sandstorm, Nimbus Manticore) Activity State-aligned cyber espionage and...

APT42 TAMECAT Malware Grows with AI-Assisted Phishing Tamecat

APT42 TAMECAT Malware Grows with AI-Assisted Phishing

Do Son July 27, 2026

At a glance Actor or group APT42 (Iran-linked; also tracked as TA453) Activity type AI-assisted spear-phishing, credential...

GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments

Do Son July 24, 2026

At a glance Malware family GoSerpent backdoor, plus McMx, Stowaway, ThumbcacheService, and TmcLoader/TmcPayload Threat actor Unconfirmed. Kaspersky...

DoNot APT Targets Bangladesh Military With a Fake Officer Biography CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

DoNot APT Targets Bangladesh Military With a Fake Officer Biography

Do Son July 23, 2026

At a glance Actor / group DoNot (APT-C-35); assessed by multiple vendors as India-aligned Activity type Targeted...

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor

Do Son July 22, 2026

At a Glance Actor or group Unnamed China-linked espionage group (per Symantec’s 2022 attribution) Activity type Suspected...

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars

Do Son July 20, 2026

At a glance Malware family HOLLOWGRAPH, linked with high confidence to the Cavern backdoor framework Threat actor...

UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments UNK_MassTraction Roundcube exploitation infection chain deploying the VShell backdoor at universities

UNK_MassTraction Roundcube exploitation infection chain deploying the VShell backdoor at universities

UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments

Do Son July 13, 2026

At a glance Actor UNK_MassTraction — suspected China-aligned espionage cluster Activity Roundcube exploitation for credential theft, webshells,...

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

At a glance Group Mustang Panda (China-aligned APT; also tracked as Hive0154) Activity Cyberespionage, spear-phishing, cloud-service C2...

Turla STOCKSTAY Backdoor Targets Ukrainian Military Turla STOCKSTAY backdoor attacks Ukrainian military targets

Turla STOCKSTAY Backdoor Targets Ukrainian Military

Do Son June 30, 2026

At a glance Malware Family: STOCKSTAY Threat Actor: Turla (Confirmed: Center 16 of Russia’s FSB) Targets: Ukrainian...

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure

Do Son June 30, 2026

At a glance Actor or Group: CL-STA-1062 (suspected Chinese-speaking actors) Activity Type: Cyber espionage and network infiltration...