Do Son APT28 used the Hookedge backdoor, SSH tunnels, and a new loader to spy on a naval shipbuilder and defense firms in two NATO countries.
Defense Industry
CERT-UA uncovers a new UAC-0099 campaign targeting Ukraine's defense sector. The group uses a toolkit of MATCHBOIL, MATCHWOK, and DRAGSTARE malware for reconnaissance and data exfiltration.
Dropping Elephant is targeting Türkiye's defense industry, particularly missile manufacturers, with weaponized conference lures, VLC DLL sideloading, and custom shellcode for intelligence exfiltration.
Stealth Falcon APT is exploiting a Windows WebDAV zero-day (CVE-2025-33053) in a sophisticated cyberespionage campaign targeting defense entities in the Middle East & Africa.