Cyberespionage Archives • Daily CyberSecurity

UAT-11587 Targets Asian Governments With Antino Backdoor

Diagram showing UAT-11587 Antino backdoor attacks and how the Antino backdoor compromises endpoints

UAT-11587 Targets Asian Governments With Antino Backdoor

Do Son October 2, 2026

UAT-11587 Antino backdoor attacks hit Asian targets. Cisco Talos reveals how the Antino backdoor abuses Microsoft 365 for cyberespionage.

China-Aligned TA419 Credential Phishing Hits AI Experts Diagram showing China-aligned TA419 credential phishing and TA419 credential phishing attack stages

Diagram showing China-aligned TA419 credential phishing and TA419 credential phishing attack stages

China-Aligned TA419 Credential Phishing Hits AI Experts

Do Son October 2, 2026

Proofpoint exposed China-aligned TA419 credential phishing targeting AI experts. This TA419 credential phishing campaign uses AitM lures to steal logins.

Konni Launches Operation Conflict Compass Against Ukraine Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Konni Launches Operation Conflict Compass Against Ukraine

Do Son September 28, 2026

SOCRadar uncovered the Konni Operation Conflict Compass campaign targeting Ukraine. Learn how Operation Conflict Compass uses fake PDFs and VelvetCake.

HEAVYGRAM Malware Abuses Telegram for Cyberespionage Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

HEAVYGRAM Malware Abuses Telegram for Cyberespionage

Do Son September 22, 2026

Group-IB uncovered Iranian HEAVYGRAM malware campaigns. The HEAVYGRAM malware abuses Telegram channels for command execution and data theft.

NightEagle APT GhostContainer Attacks Target Russia

NightEagle APT GhostContainer attacks on Exchange servers

NightEagle APT GhostContainer Attacks Target Russia

Do Son September 21, 2026

Learn how the NightEagle APT GhostContainer attacks exploit Exchange servers in Russia. Protect your network from the NightEagle APT.

Dark Caracal Deploys New GoCaracal Malware Framework Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Dark Caracal Deploys New GoCaracal Malware Framework

Do Son September 1, 2026

Researchers detected the Dark Caracal GoCaracal malware in South America. Learn how this GoCaracal malware uses Ethereum smart contracts.

SilkParasite APT Hits Central Asian Governments With 7 RATs SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT Hits Central Asian Governments With 7 RATs

Do Son August 27, 2026

SilkParasite APT ran China-nexus cyberespionage across Central Asia, using 7 custom RATs, DLL sideloading, and AI-assisted malware.

Core Werewolf Deploys New CoreRAT Malware Against Russian Targets CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

Core Werewolf Deploys New CoreRAT Malware Against Russian Targets

Do Son August 25, 2026

CoreRAT malware powers Core Werewolf attacks on Russian defense and government targets, using fake military PDFs and Telegram phishing.

Armored Likho Still Toolkit Deploys Covert Spying Implants Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit Deploys Covert Spying Implants

Do Son August 19, 2026

Kaspersky uncovered the Armored Likho Still Toolkit. Read our Armored Likho Still Toolkit analysis to explore the Telegram stealer and audio spying tools.

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel

Do Son July 21, 2026

Kaspersky details Project CAV3RN, an OilRig-linked cyberespionage framework. Its new module hides C2 in Outlook calendar events, with DNS AAAA fallback.

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign

Do Son June 29, 2026

Kaspersky details SharkLoader malware, which deploys Cobalt Strike Beacon in the global StrikeShark campaign via DLL sideloading and exploited apps.

APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation APT37 Phishing Campaign Python Malware Obfuscation

APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation

Do Son May 12, 2026

Genians unmasks an APT37 campaign using environment variable tricks and compiled Python malware to bypass EDR. Protect your network from these stealthy lures.

Fileless Python Malware Uses Humanitarian Lures to Deploy Full-Spectrum Surveillance Python Cyberespionage Fileless Malware

Fileless Python Malware Uses Humanitarian Lures to Deploy Full-Spectrum Surveillance

Do Son May 11, 2026

CRIL exposes a cyberespionage campaign using fake humanitarian aid forms to deploy fileless Python malware via GitHub for full-spectrum surveillance.

Cisco Talos Unmasks UAT-8302’s Global Government Espionage Network UAT-8302 APT NetDraft Malware

Cisco Talos Unmasks UAT-8302’s Global Government Espionage Network

Do Son May 6, 2026

Cisco Talos exposes UAT-8302, a China-linked APT group infiltrating governments via NetDraft and CloudSorcerer. Learn how they share tools with notorious APTs.

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits SHADOW-EARTH-053 ShadowPad Espionage

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026

SHADOW-EARTH-053 is breaching governments and NATO using old ProxyLogon flaws and ShadowPad. Learn how this China-aligned group stays hidden via registry loading.

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens AI Tool Targeting Contagious Interview

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens

Do Son April 10, 2026

North Korean hackers are now targeting AI tools like Cursor and Claude. The OtterCookie malware steals API keys and conversation logs. Is your dev environment safe?

New Phishing Campaign Abuses GitHub to Target South Korea GitHub C2 LNK Malware

New Phishing Campaign Abuses GitHub to Target South Korea

Do Son April 9, 2026

FortiGuard Labs unmasks a South Korean espionage wave abusing the GitHub API for C2 and using LNK files to stay invisible. Protect your network from LotL.

The Triple-Headed Dragon: Inside the Three-Cluster Chinese Cyberespionage Campaign Targeting SE Asia UNC5221 HAFNIUM Extradition PRC State Espionage

UNC5221 HAFNIUM Extradition PRC State Espionage

The Triple-Headed Dragon: Inside the Three-Cluster Chinese Cyberespionage Campaign Targeting SE Asia

Do Son April 2, 2026

Unit 42 uncovers a massive 3-cluster cyberespionage campaign by China-aligned actors in SE Asia using USBFect, Hypnosis loaders, and stealthy RATs.

The Invisible Breach: ‘Operation GhostMail’ Uses Zero-Click XSS to Hijack Ukrainian Webmail Operation GhostMail Zero-Click XSS

The Invisible Breach: ‘Operation GhostMail’ Uses Zero-Click XSS to Hijack Ukrainian Webmail

Do Son March 20, 2026

Seqrite Labs uncovers Operation GhostMail, an APT28-linked campaign using a zero-click XSS flaw in Zimbra to silently hijack Ukrainian government webmail.

Hijacked Accounts and AI Code: The Deadly New Playbook of Iranian APT ‘Boggy Serpens’ Boggy Serpens Iranian APT

Hijacked Accounts and AI Code: The Deadly New Playbook of Iranian APT ‘Boggy Serpens’

Do Son March 20, 2026

Unit 42 reveals Iranian APT Boggy Serpens is weaponizing hijacked accounts, AI-generated code, and Rust malware to infiltrate critical infrastructure.

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

Do Son March 10, 2026

Chinese APTs like Camaro Dragon are targeting Qatar with PlugX malware and Cobalt Strike, weaponizing Middle East tensions for cyberespionage.

Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive Vulnerability Digest Zero-Day Exploits Seedworm APT Dindoor Backdoor RedKitten Campaign AI-Generated Malware WSUS RCE ShadowPad CVE-2025-59287

Vulnerability Digest Zero-Day Exploits Seedworm APT Dindoor Backdoor RedKitten Campaign AI-Generated Malware WSUS RCE ShadowPad CVE-2025-59287

Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive

Do Son March 9, 2026

Iranian APT Seedworm intensifies cyberespionage against US and Israeli networks using a new stealth backdoor called Dindoor. Read the full threat report.