Tag: apt
-
Debian and Ubuntu Linux APT Vulnerability Allows Attackers to Execute Malicious Code With Root Privileges
A vulnerability in the APT package manager lets attackers intercept communications between Linux systems and package repositories, install malicious packages, and execute code with root privileges. This flaw, tracked as CVE-2026-109518, affects Debian, Ubuntu, and their derivative distributions under certain download conditions. Debian disclosed the issue in its DSA-6607-1 security advisory on November 4, 2026,…
-
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.The attacker’s code then runs as root, according to advisories that Debian, Ubuntu, and APT’s developers published on November 4. The attack needs APT to retry failed downloads, which…
-
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Tags: apt, control, cve, cyber, cyberespionage, defense, exploit, group, intelligence, law, malware, russia, threat, ukraine, vulnerabilityA targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations. Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control The findings, detailed…
-
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
Tags: apt, control, cve, cyber, cyberespionage, defense, exploit, group, intelligence, law, malware, russia, threat, ukraine, vulnerabilityA targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against Ukrainian organizations. Active since at least February 2025, the group prioritizes law enforcement, justice institutions, frontline local administrations, and defense organizations, using compact malware designed for rapid intelligence collection rather than prolonged remote control The findings, detailed…
-
Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware
ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/gorbag-apt-group-malware/
-
DarkBlinders APT Hackers Target Israel and Iraqi Kurdistan With StarkMeet Malware and GitHub-Based Backdoors
Tags: apt, backdoor, cloud, credentials, cyber, cyberespionage, github, government, hacker, iraq, malware, phishing, theftDarkBlinders has compromised a high-profile Israeli individual associated with the security sector and a government cloud environment in Iraqi Kurdistan, combining credential phishing, a fake meeting application, and GitHub-based backdoors. Dream Security observed the cyberespionage campaign between August and October 2026 and reported that it remained active at publication. Confirmed activity included credential theft and…
-
ESET APT Activity Report, Q2 – Q3 2026
Tags: aptEin Überblick über die Aktivitäten ausgewählter APT-Gruppen, die von ESET im 2. Quartal 2026 und im 3. Quartal 2026 untersucht und analysiert wurden First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/eset-apt-activity-report-q2-q3-2026/
-
BITTER APT Using Fake Diplomatic Documents to Deliver PapRAT Spyware
FortiGuard Labs links BITTER to cyberespionage attacks on South Asian organizations using malicious Windows shortcuts, PowerShell scripts, and PapRAT malware. First seen on hackread.com Jump to article: hackread.com/bitter-apt-fake-diplomatic-documents-paprat-spyware/
-
FBI Attributes Binance Heist to North Korea’s TraderTraitor
The FBI has blamed North Korean APT group TraderTraitor for the world’s biggest cyber heist First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/fbi-attributes-binance-north/
-
Russian Hackers Exploit MDaemon Mail Server Flaw to Install Backdoors Without User Interaction
Russia-aligned threat actors are exploiting a flaw in MDaemon mail server software to run code on the server. Victims don’t have to open or click anything. ESET’s APT Activity Report for Q2Q3 2026 describes an active campaign in Ukraine. ESET could not attribute it to a known Russia-aligned group. Mdaemon mail server flaw According to…
-
Hackers Target Asian Governments With New NetamLoader Malware Hidden in Windows Update Files
Kaspersky researchers have uncovered NetamLoader, a .NET loading framework built on XAML markup. It appears to be a supply-chain attack on a customized Windows build used only by Asian government bodies. No known APT group has been linked to it. NetamLoader malware Kaspersky Security Network flagged a .config file that used AppDomainManager injection to load…
-
Volt Typhoon targeted enterprise control planes via ever-changing >>Silent Train<< relay network
Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/29/volt-typhoon-silent-train-relay-network/
-
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
Volt Typhoon used disposable relay chains to hide zero-day attacks on critical systems. Lumen linked Silent Train to at least four zero-days. Lumen’s Black Lotus Labs has spent three years tracking a covert network it calls Silent Train, which it ties to Volt Typhoon, the China-linked APT group. The cybersecurity firm says the network hid…
-
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-11985/
-
UAT-11985: AI-assisted event lures delivering real-time Google AitM phishing
Cisco Talos identified an APT spear-phishing campaign against individuals affiliated with Taiwan research organizations. The operation leveraged legitimate public event themes and impersonated reputable academic and policy institutions. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/uat-11985/
-
Warlock Ransomware Hits Large Spanish, Portuguese Orgs
A year-old Chinese threat actor looks like a cybercrime gang, acts like a state-associated APT, and attacks organizations in unexpected places. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/warlock-ransomware-spanish-portuguese
-
Russia’s Star Blizzard Ditches ClickFix to Widen Phishing Net
The APT actor is using a new tactic, dubbed RedFlick, against Ukrainian-linked targets such as NGOs, think tanks, and journalists to deploy its CosmicPulse backdoor. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/russia-star-blizzard-apt-ditches-clickfix-widen-phishing-net
-
Chinese APT Clones Legitimate Websites to Deliver Chrome and Windows Zero-Day Exploits
A third Chinese threat actor has been linked to phishing campaigns that cloned trusted websites and chained Chrome and Windows zero-day exploits to deploy a previously undocumented backdoor. The activity occurred on September 3 and 4, 2026, while the targeted vulnerabilities remained unpatched in Google Chrome. It followed Volexity’s September 9 disclosure that UTA0560 and…
-
NightEagle Uses BlueKeep and DCSync to Move Toward Active Directory Domain Controllers
NightEagle, an espionage-focused threat group also tracked as APT-Q-95, has expanded its operations from Asian targets to Russian organizations, using a layered intrusion chain that culminates in attempts to compromise Active Directory domain controllers. The campaign illustrates a familiar but dangerous enterprise compromise pattern: attackers do not need a novel zero-day exploit when exposed remote…
-
China’s FamousSparrow APT Spies on US Politics in Latin America
Amid the US and China’s fight for eco-colonial influence in Latin America, a stealthy backdoor has taken flight. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-spies-latin-america
-
NightEagle Hackers Abuse Microsoft Dev Tunnels and GhostContainer to Breach Russian Companies
The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks. Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously…
-
NightEagle Hackers Target Russian Companies Using GhostContainer Backdoor
The NightEagle advanced persistent threat group, tracked as APT-Q-95, has expanded its operations to target businesses in Russia, combining stolen VPN credentials, a stealthy Microsoft Exchange backdoor, and legitimate tunneling technologies to move through victim networks. Researchers from Kaspersky’s Global Emergency Response Team said the group has been active since at least 2023 and previously…
-
Three Threat Groups Target Russian Enterprises With Backdoors, Ransomware, and Wipers
Enterprises in Russia have emerged as the target of three threat activity clusters tracked as NightEagle, Hacking Cat, and Toy Ghouls, according to multiple reports from Kaspersky.The cybersecurity vendor said it has identified attacks mounted by NightEagle (aka APT-Q-95), a threat actor known to be active since at least 2023, that involve new techniques for…
-
Pentest bestanden und trotzdem gehackt: Wo Red Teaming und APT Simulationen mehr bieten
Die Firma hat den Pentest bestanden, wurde aber trotzdem gehackt? Erfahre, warum Red Teaming und APT-Simulationen die IT-Abwehr verbessern. First seen on tarnkappe.info Jump to article: tarnkappe.info/artikel/gast-artikel/pentest-bestanden-und-trotzdem-gehackt-wo-red-teaming-und-apt-simulationen-mehr-bieten-333471.html
-
Cisco FMC Flaws Give Ransomware and APTs a Path Into Internal Networks
Cisco Talos says attackers are exploiting FMC flaws to steal credentials, tunnel into internal networks, and deploy Qilin ransomware. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/news-cisco-fmc-vulnerabilities/
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 114
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter REVSTEALER ramps up Breaking the Seal: Static Deobfuscation of JSCeal’s Compiled V8 Bytecode GuardBreaker: Derailing AI-assisted malware analysis with a code comment DPRK APTs: Ted backdoor and curlRAT target South Korean media and automotive…
-
Iran-linked APT Mirage Kitten Uses Fake Job Tests to Spread Malware
Mirage Kitten used fake LinkedIn coding tests to spread NodeRabbit and PollCat, even banning AI tools that could have spotted the malware. Iran-linked Mirage Kitten hackers just found a genuinely clever way to make their own malware harder to detect: telling job candidates not to use AI tools while reviewing the trojanized code they were…
-
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
BlueDelta (APT28) uses webhook.site and Microsoft Edge to hide HOOKEDGE espionage traffic targeting European governments. Recorded Future’s Insikt Group documented a campaign by BlueDelta, the Russian GRU-linked group that overlaps with the group APT28, running an entire espionage operation against European government targets using webhook.site, a service built for developers to test HTTP requests, as…
-
Nimbus Manticore Expands Toolset With TWOSTROKE-Like Backdoor and SSH Tunneler
Cybersecurity researchers have discovered additional infrastructure and previously undocumented malware associated with Nimbus Manticore, an Iranian state-sponsored hacking group affiliated with the Islamic Revolutionary Guard Corps (IRGC).Group-IB, in a new analysis published today, described the cyber espionage actor as among the most active Iranian APT groups in 2026. Nimbus Manticore (aka First seen on thehackernews.com…