Do Son Symantec exposed a Russian-aligned espionage campaign in Ukraine using LotL tactics. Attackers used a Sandworm-linked webshell (Localolive) and abused scheduled tasks to dump credentials and bypass Windows Defender.
Espionage
Trellix exposed SideWinder APT's campaign against South Asian diplomacy. It uses PDF/ClickOnce lures with a signed MagTek binary to deploy StealerBot for deep intelligence collection.
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec Exposes Chinese APT Overlap: Zingdoor, ShadowPad, and KrustyLoader Used in Global Espionage
Symantec exposed a complex Chinese APT network (Glowworm/UNC5221) deploying Zingdoor and ShadowPad across US/South American targets. The groups abuse DLL sideloading and PetitPotam for credential theft.
Cisco Talos exposed Famous Chollima using fake job offers and a trojanized Node.js app (Chessfi) to infect developers. The OtterCookie RAT steals crypto wallets, credentials, and source code.
Seqrite exposed Operation Silk Lure, a campaign using a malicious Chinese resume (.LNK) to implant ValleyRAT on FinTech systems. It achieves persistence via a “Security” scheduled task and uninstalls AV.
A Chinese APT used fake Cloudflare verification pages and malicious LNK files to inject PlugX via DLL sideloading into a Serbian aviation agency, aiming for long-term espionage.
APT SideWinder launched Operation SouthNet, targeting South Asia with over 50 malicious phishing portals hosted on Netlify and pages.dev to steal government and military credentials.
Unit 42 uncovers Phantom Taurus, a new Chinese APT using the fileless NET-STAR backdoor to target SQL databases and IIS servers in global espionage campaigns.
A Chinese APT, RedNovember, is using backdoors like Pantegana and SparkRAT to expand its global espionage, targeting U.S. defense, aerospace, and tech firms.
Russia-linked APT COLDRIVER is using a new multi-stage malware campaign (BAITSWITCH/SIMPLEFIX) with a ClickFix lure to target journalists and activists for espionage.
GTIG reveals BRICKSTORM, a stealthy Go backdoor linked to China-nexus UNC5221, targeting US legal/SaaS firms to steal IP and establish long-term espionage access.
A new report reveals Chinese threat actor TA415 is targeting U.S. policy organizations with sophisticated spearphishing campaigns to gather intelligence.
A DomainTools report exposes how North Korean IT workers use fake IDs, AI, and shell companies to infiltrate remote tech jobs globally, funding the regime's military and compromising corporate infrastructure.
Christina Marie Chapman was sentenced to 8.5 years for facilitating a $17M scheme that allowed North Korean IT operatives to pose as US citizens and secure remote jobs at over 300 US companies.
Proofpoint reveals two Russian threat clusters (TA829 & UNK_GreenSec) blending financial cybercrime with state-aligned espionage, using RomCom and TransferLoader malware.
Hackers leaked 7.4 million Paraguayan citizen records on the dark web, demanding a $7.4M ransom. The breach likely stems from infostealer malware, sparking national security concerns.
"SmartAttack" reveals a new threat: smartwatches can act as covert ultrasonic receivers, exfiltrating data from air-gapped systems via sound waves.
Symantec reports a Fog ransomware attack on an Asian bank that used unusual tools like employee monitoring software and an APT-linked backdoor, suggesting possible espionage.
Cyberattacks are surging against the energy sector, driven by geopolitical tensions. Ransomware, espionage, and supply chain attacks pose major threats.