GTIG Archives • Daily CyberSecurity

UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering

Diagram of the AOMEI supply chain attack and AOMEI supply chain attack UNC7017 update workflow #AOMEISupplyChainAttack #UNC7017

UNC7017 Executes AOMEI Supply Chain Attack Using Five-Minute Server Tampering

Do Son October 19, 2026

Google and Mandiant uncovered the AOMEI supply chain attack UNC7017 campaign using 5-minute server tampering to drop CROSSROAD and SHINYROAD malware.

Google Tracks Russian Cyber Espionage Clusters

Google tracks suspected Russian cyber espionage clusters and Russian cyber espionage clusters abusing authentication flows

Google Tracks Russian Cyber Espionage Clusters

Do Son August 28, 2026

Google tracks suspected Russian cyber espionage clusters abusing logins. Learn how these Russian cyber espionage clusters target global officials.

Unmasking DarkSword: GTIG Exposes Full-Chain iOS Exploit Used by Global Spies DarkSword Exploit iOS Zero-Day

Unmasking DarkSword: GTIG Exposes Full-Chain iOS Exploit Used by Global Spies

Do Son March 22, 2026

Google uncovers DarkSword, a sophisticated iOS full-chain exploit used globally to deploy spyware via zero-day vulnerabilities. Update to iOS 26.3 now.

Coruna: The High-Powered iOS Exploit Kit Proliferating Across the Global Threat Landscape Coruna iOS Exploit GTIG Threat Report

Coruna: The High-Powered iOS Exploit Kit Proliferating Across the Global Threat Landscape

Do Son March 5, 2026

Google Threat Intelligence uncovers "Coruna", a repurposed iOS exploit kit now used by state-sponsored and financially motivated hackers to steal crypto.

Under Siege: GTIG Report Exposes North Korean Spies & Russian Drone Hacks in Defense Sector

GemStuffer RubyGems Campaign RubyGems Data Exfiltration TanStack npm Compromise Supply Chain Attack DNS Hijacking APT28 (Fancy Bear) OpenVSX Supply Chain Attack Checkmarx Plugin Breach Stryker Cyberattack CISA Alert Trans-Regional Cyber Conflict Operation Epic Fury Cyber Operation MacroMaze APT28 Cyber Espionage Notepad++ Supply Chain Attack Lotus Blossom Group Defense Industrial Base Threats GTIG Report APT28 Operation Neusploit CVE-2026-21509 Bookworm Malware

Under Siege: GTIG Report Exposes North Korean Spies & Russian Drone Hacks in Defense Sector

Do Son February 11, 2026

GTIG report: Defense Industrial Base faces "constant siege" from Russian drone hackers & North Korean IT insiders. Learn the new threats.

React2Shell: Max-Score RCE (CVSS 10.0) Triggers Widespread Exploitation by Espionage Groups & Miners React2Shell RCE, Widespread Exploitation

React2Shell: Max-Score RCE (CVSS 10.0) Triggers Widespread Exploitation by Espionage Groups & Miners

Do Son December 13, 2025

A critical RCE (CVSS 10.0) in React Server Components (CVE-2025-55182) is under widespread exploitation by China-nexus groups deploying MINOCAT and HISONIC backdoors, plus XMRig miners.

Spyware Vendor Intellexa Used 15 Zero-Days Since 2021, Deploying Predator via “smack” iOS Exploit Chain Intellexa Zero-Days, Predator Spyware

Spyware Vendor Intellexa Used 15 Zero-Days Since 2021, Deploying Predator via “smack” iOS Exploit Chain

Do Son December 8, 2025

Google exposed Intellexa (Predator spyware vendor) using 15 zero-days since 2021, including the iOS "smack" exploit chain (JSKit). Google is issuing mass warnings to targeted users globally.

UNC6040 Threat Actor Exploits Salesforce via Vishing and Malicious Data Loader Apps Salesforce Gainsight Breach AppExchange Security Vishing, Salesforce Attack UNC6040

Salesforce Gainsight Breach AppExchange Security Vishing, Salesforce Attack UNC6040

UNC6040 Threat Actor Exploits Salesforce via Vishing and Malicious Data Loader Apps

Do Son June 6, 2025

UNC6040 is using sophisticated vishing to breach Salesforce, tricking employees into granting access, exfiltrating data, and then pivoting to other cloud platforms.