Cyberespionage Archives • Daily CyberSecurity

UAT-11587 Targets Asian Governments With Antino Backdoor Diagram showing UAT-11587 Antino backdoor attacks and how the Antino backdoor compromises endpoints

Diagram showing UAT-11587 Antino backdoor attacks and how the Antino backdoor compromises endpoints

UAT-11587 Targets Asian Governments With Antino Backdoor

Do Son October 2, 2026

At a Glance Attribute Details Actor or Group UAT-11587 (suspected China-nexus group; overlaps with Jewelbug) Activity Type...

China-Aligned TA419 Credential Phishing Hits AI Experts Diagram showing China-aligned TA419 credential phishing and TA419 credential phishing attack stages

Diagram showing China-aligned TA419 credential phishing and TA419 credential phishing attack stages

China-Aligned TA419 Credential Phishing Hits AI Experts

Do Son October 2, 2026

At a Glance Summary Attribute Details Actor or Group TA419 (China-aligned cyberespionage group) Activity Type Spear-phishing, AitM...

Konni Launches Operation Conflict Compass Against Ukraine Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Diagram of Konni Operation Conflict Compass showing the Operation Conflict Compass infection chain

Konni Launches Operation Conflict Compass Against Ukraine

Do Son September 28, 2026

At a Glance Attribute Details Actor or Group Konni (also tracked as TA406 and Opal Sleet; suspected...

HEAVYGRAM Malware Abuses Telegram for Cyberespionage Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

Diagram of Iranian HEAVYGRAM malware illustrating how HEAVYGRAM malware compromises endpoints

HEAVYGRAM Malware Abuses Telegram for Cyberespionage

Do Son September 22, 2026

At a Glance Attribute Details Malware Family HEAVYGRAM (associated with CRUDEEXCLUDE) Threat Actor Handala Hack (suspected persona...

NightEagle APT GhostContainer Attacks Target Russia

NightEagle APT GhostContainer attacks on Exchange servers

NightEagle APT GhostContainer Attacks Target Russia

Do Son September 21, 2026

At a Glance Actor or group: NightEagle (also tracked as APT-Q-95). Activity type: Cyberespionage, tunneling, and Active...

Dark Caracal Deploys New GoCaracal Malware Framework Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Diagram showing the Dark Caracal GoCaracal malware attack chain and GoCaracal malware framework

Dark Caracal Deploys New GoCaracal Malware Framework

Do Son September 1, 2026

At a Glance Category Details Threat Actor Dark Caracal (suspected connection to Lebanese GDGS) Activity Type Cyberespionage,...

SilkParasite APT Hits Central Asian Governments With 7 RATs SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT diagram showing China-nexus cyberespionage attack chain with DLL sideloading and RAT deployment across Central Asia

SilkParasite APT Hits Central Asian Governments With 7 RATs

Do Son August 27, 2026

At a Glance Actor / group SilkParasite (activity cluster; China-nexus assessed at medium confidence) Activity type Cyberespionage...

Core Werewolf Deploys New CoreRAT Malware Against Russian Targets CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

CoreRAT malware decoy PDF used in Core Werewolf phishing attack on Russian defense targets

Core Werewolf Deploys New CoreRAT Malware Against Russian Targets

Do Son August 25, 2026

At a glance Actor / group Core Werewolf (suspected cyberespionage cluster) Activity type Phishing, remote access trojan,...

Armored Likho Still Toolkit Deploys Covert Spying Implants Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit architecture and Armored Likho Still Toolkit analysis flow

Armored Likho Still Toolkit Deploys Covert Spying Implants

Do Son August 19, 2026

At a glance Actor or group: Armored Likho (also known as Eagle Werewolf) Activity type: Cyber espionage...

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN cyberespionage framework using Outlook calendar C2 and Microsoft Graph

Project CAV3RN Hides Its C2 in Outlook Calendar Events to Spy on Israel

Do Son July 21, 2026

At a glance Threat actor Project CAV3RN cluster; linked to OilRig (APT34) with low confidence Activity type...

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader malware infection chain deploying Cobalt Strike Beacon in the StrikeShark campaign

SharkLoader Malware Deploys Cobalt Strike in Global StrikeShark Campaign

Do Son June 29, 2026

At a glance Field Detail Malware family SharkLoader (loader) delivering Cobalt Strike Beacon Threat actor StrikeShark; unattributed,...

APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation APT37 Phishing Campaign Python Malware Obfuscation

APT37’s New “Python-in-a-Cat” Malware Uses Environment Variable Obfuscation

Do Son May 12, 2026

In the world of cyberespionage, familiarity can be a fatal mistake for defenders. Just as security teams...

Fileless Python Malware Uses Humanitarian Lures to Deploy Full-Spectrum Surveillance Python Cyberespionage Fileless Malware

Fileless Python Malware Uses Humanitarian Lures to Deploy Full-Spectrum Surveillance

Do Son May 11, 2026

According to the latest intelligence from Cyble Research and Intelligence Labs (CRIL), threat actors are actively demonstrating...

Cisco Talos Unmasks UAT-8302’s Global Government Espionage Network UAT-8302 APT NetDraft Malware

Cisco Talos Unmasks UAT-8302’s Global Government Espionage Network

Do Son May 6, 2026

Cisco Talos has exposured the curtain on UAT-8302, a sophisticated, China-nexus advanced persistent threat (APT) group that...

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits SHADOW-EARTH-053 ShadowPad Espionage

The N-Day Nightmare: How SHADOW-EARTH-053 Breaches Governments Using “Old” Exploits

Do Son May 5, 2026

TrendAI Research has identified a persistent and methodical China-aligned threat cluster targeting government entities and critical infrastructure...

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens AI Tool Targeting Contagious Interview

North Korean Hackers Pivot to AI: New npm Malware Targets Cursor, Claude, and Gemini Tokens

Do Son April 10, 2026

In a calculated move that signals a new frontier in cyber espionage, North Korean threat actors have...

New Phishing Campaign Abuses GitHub to Target South Korea GitHub C2 LNK Malware

New Phishing Campaign Abuses GitHub to Target South Korea

Do Son April 9, 2026

A sophisticated new cyberespionage campaign is leveraging the trust of major public platforms to slip past corporate...

The Triple-Headed Dragon: Inside the Three-Cluster Chinese Cyberespionage Campaign Targeting SE Asia UNC5221 HAFNIUM Extradition PRC State Espionage

UNC5221 HAFNIUM Extradition PRC State Espionage

The Triple-Headed Dragon: Inside the Three-Cluster Chinese Cyberespionage Campaign Targeting SE Asia

Do Son April 2, 2026

A recent investigation by Unit 42 researchers has exposed a massive, persistent cyberespionage campaign targeting a high-value...

The Invisible Breach: ‘Operation GhostMail’ Uses Zero-Click XSS to Hijack Ukrainian Webmail Operation GhostMail Zero-Click XSS

The Invisible Breach: ‘Operation GhostMail’ Uses Zero-Click XSS to Hijack Ukrainian Webmail

Do Son March 20, 2026

A sophisticated cyberespionage campaign, dubbed Operation GhostMail, has been detected targeting critical government infrastructure in Ukraine. Security...

Hijacked Accounts and AI Code: The Deadly New Playbook of Iranian APT ‘Boggy Serpens’ Boggy Serpens Iranian APT

Hijacked Accounts and AI Code: The Deadly New Playbook of Iranian APT ‘Boggy Serpens’

Do Son March 20, 2026

A new assessment from Unit 42 reveals a significant maturation in the tactics of Boggy Serpens, an...

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX

Do Son March 10, 2026

Following recent regional escalations, researchers have identified a sharp increase in activity from Chinese-nexus APT (Advanced Persistent...

Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive Vulnerability Digest Zero-Day Exploits Seedworm APT Dindoor Backdoor RedKitten Campaign AI-Generated Malware WSUS RCE ShadowPad CVE-2025-59287

Vulnerability Digest Zero-Day Exploits Seedworm APT Dindoor Backdoor RedKitten Campaign AI-Generated Malware WSUS RCE ShadowPad CVE-2025-59287

Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive

Do Son March 9, 2026

As geopolitical tensions escalate in the Middle East, the digital battlefield is seeing a parallel surge in...