cyber-espionage Archives • Daily CyberSecurity

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys Diagram showing how Kimsuky uses the AI agent opencode to generate phishing lures

Kimsuky Uses AI Agent Opencode to Create Phishing Decoys

Do Son September 10, 2026

At a glance Field Details Actor or Group Kimsuky (North Korean state-sponsored threat group) Activity Type Spearphishing,...

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days Diagram of BlueMoon exploit kit campaigns deploying the BlueMoon exploit kit against Chrome

Diagram of BlueMoon exploit kit campaigns deploying the BlueMoon exploit kit against Chrome

BlueMoon Exploit Kit Chains Chrome and Windows Zero-Days

Do Son September 9, 2026

Proofpoint threat researchers uncovered state-aligned espionage groups deploying zero-day browser exploit chains in late August 2026. Field...

Operation QUICSILVER Targets Myanmar Government With Go Backdoor Operation QUICSILVER infection chain showing VHD lure delivering the QUICAgent Go backdoor to Myanmar government targets

Operation QUICSILVER infection chain showing VHD lure delivering the QUICAgent Go backdoor to Myanmar government targets

Operation QUICSILVER Targets Myanmar Government With Go Backdoor

Do Son August 21, 2026

At a glance Actor or group Unnamed China-nexus actor (moderate confidence) Activity type Cyber espionage, custom Go...

Jewelbug APT Group Operations Combine Espionage and Fraud CVE-2024-3393 - Zservers sanctions

Jewelbug APT Group Operations Combine Espionage and Fraud

Do Son August 20, 2026

At a glance Actor or group: Jewelbug (suspected China-based threat group) Activity type: Cyber espionage and cryptocurrency...

PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign PATCHCORD malware APT36 SHEETCORD malware Afghan telecom diagram

PATCHCORD Malware Hits Afghan Telecom in New APT36 Campaign

Do Son August 19, 2026

At a glance Actor/Group APT36 / Transparent Tribe (moderate confidence) Activity Type Cyber espionage; custom backdoor delivery...

Project CAV3RN Framework Adds DNS and Google Relays Project CAV3RN framework architecture and Project CAV3RN framework analysis diagram

Project CAV3RN Framework Adds DNS and Google Relays

Do Son August 17, 2026

At a glance Malware family: Project CAV3RN Threat actor: Unattributed cyber espionage cluster Target or victims: Targeted...

OctLurk and SilkLurk backdoors targeting Central Asian government espionage campaign

OctLurk and SilkLurk Backdoors Hit Central Asian Government Networks

Do Son August 5, 2026

At a glance Field Detail Malware family OctLurk (plugin-based backdoor); SilkLurk (plugin-based backdoor); LurkProxy (network proxy utility)...

Mirage Kitten Deploys New Malware Against Middle East and Africa Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten malware campaign map showing UNC1549 espionage targets across the Middle East and Africa

Mirage Kitten Deploys New Malware Against Middle East and Africa

Do Son August 1, 2026

At a glance Actor Mirage Kitten (also UNC1549, Smoke Sandstorm, Nimbus Manticore) Activity State-aligned cyber espionage and...

APT42 TAMECAT Malware Grows with AI-Assisted Phishing Tamecat

APT42 TAMECAT Malware Grows with AI-Assisted Phishing

Do Son July 27, 2026

At a glance Actor or group APT42 (Iran-linked; also tracked as TA453) Activity type AI-assisted spear-phishing, credential...

GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent backdoor cyber espionage attack chain against Southeast Asian government networks

GoSerpent Backdoor Drives a Patient Cyber Espionage Campaign Against Southeast Asian Governments

Do Son July 24, 2026

At a glance Malware family GoSerpent backdoor, plus McMx, Stowaway, ThumbcacheService, and TmcLoader/TmcPayload Threat actor Unconfirmed. Kaspersky...

DoNot APT Targets Bangladesh Military With a Fake Officer Biography CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

CRussian Market, "Fly" (Flyded) hange Healthcare Cyberattack - CVE-2024-50603 Exploit

DoNot APT Targets Bangladesh Military With a Fake Officer Biography

Do Son July 23, 2026

At a glance Actor / group DoNot (APT-C-35); assessed by multiple vendors as India-aligned Activity type Targeted...

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Daxin Malware Resurfaces in Taiwan Alongside New Stupig Backdoor

Do Son July 22, 2026

At a Glance Actor or group Unnamed China-linked espionage group (per Symantec’s 2022 attribution) Activity type Suspected...

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH malware using Microsoft Graph API abuse to hide command-and-control inside a Microsoft 365 calendar event dated 2050

HOLLOWGRAPH Malware Hides Command-and-Control in Microsoft 365 Calendars

Do Son July 20, 2026

At a glance Malware family HOLLOWGRAPH, linked with high confidence to the Cavern backdoor framework Threat actor...

UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments UNK_MassTraction Roundcube exploitation infection chain deploying the VShell backdoor at universities

UNK_MassTraction Roundcube exploitation infection chain deploying the VShell backdoor at universities

UNK_MassTraction Exploits Roundcube Webmail to Hit University Physics Departments

Do Son July 13, 2026

At a glance Actor UNK_MassTraction — suspected China-aligned espionage cluster Activity Roundcube exploitation for credential theft, webshells,...

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

AccountDumpling Phishing Google AppSheet Abuse AI-Generated Malware PureRAT Campaign RondoDoX Botnet, Next.js React2Shell EchoGather, Paper Werewolf Salt Typhoon, Telecom Espionage BreachForums, Conor Fitzpatrick Ransomware Negotiation, DOJ Investigation MirrorFace group - Earth Kasha Emperor Dragonfly

Mustang Panda Abuses Zoho WorkDrive in Espionage Attacks on India’s Government

Do Son July 2, 2026

At a glance Group Mustang Panda (China-aligned APT; also tracked as Hive0154) Activity Cyberespionage, spear-phishing, cloud-service C2...

Turla STOCKSTAY Backdoor Targets Ukrainian Military Turla STOCKSTAY backdoor attacks Ukrainian military targets

Turla STOCKSTAY Backdoor Targets Ukrainian Military

Do Son June 30, 2026

At a glance Malware Family: STOCKSTAY Threat Actor: Turla (Confirmed: Center 16 of Russia’s FSB) Targets: Ukrainian...

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

TinyRCT Backdoor Attacks Target Asian Critical Infrastructure

Do Son June 30, 2026

At a glance Actor or Group: CL-STA-1062 (suspected Chinese-speaking actors) Activity Type: Cyber espionage and network infiltration...

Google Uncovers UNC6508 Cyber Espionage Campaign Diagram showing UNC6508 cyber espionage attack flow and INFINITERED malware.

Google Uncovers UNC6508 Cyber Espionage Campaign

Do Son June 22, 2026

At a Glance Actor: UNC6508 (suspected PRC-nexus threat actor) Activity Type: Cyber espionage, bespoke malware deployment, data...

VerdantBamboo malware campaign Volexity threat report

VerdantBamboo Malware Campaign Targets Edge Devices via Supply Chain Breach

Do Son June 10, 2026

A sophisticated cyber espionage operation has compromised several enterprise networks by targeting unguarded edge devices. Security investigators...

Cyber Espionage Campaign Targets Global Stock Exchange Executive AdaptixC2 Abuse, Russian Cybercrime RondoDox Botnet, Exploit Shotgun China Cyber Power, Red Hackers Nvidia cyberattack

AdaptixC2 Abuse, Russian Cybercrime RondoDox Botnet, Exploit Shotgun China Cyber Power, Red Hackers Nvidia cyberattack

Cyber Espionage Campaign Targets Global Stock Exchange Executive

Do Son June 8, 2026

Severe Infrastructure Exposure Discovered An unknown threat actor recently executed a highly disciplined cyber operation against a...

Operation Dragon Weave Exposed: Cyber Espionage Campaign Weaponizes Cloud Storage Operation Dragon Weave dead-drop C2 channel

Operation Dragon Weave Exposed: Cyber Espionage Campaign Weaponizes Cloud Storage

Do Son June 4, 2026

Security researchers have discovered a highly targeted international cyber espionage offensive hitting public institutions. Specifically, the Seqrite...

Kimsuky HttpSpy malware campaign JSONPing execution check

Kimsuky HttpSpy Malware Campaign Exploits Networks via Deceptive Overlays

Do Son June 3, 2026

The ENKI Whitehat Threat Research Team recently exposed an advanced cyber espionage operation. Specifically, the notorious Kimsuky...

Critical Alert 3 Active Exploits Detected Today