Tag: apt
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Tags: apt, data, espionage, government, intelligence, malicious, military, monitoring, russia, spy, threat, ukraineRussia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. >>Recent monitoring data from the 360 “‹”‹Advanced…
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Tags: apt, data, espionage, government, intelligence, malicious, military, monitoring, russia, spy, threat, ukraineRussia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. >>Recent monitoring data from the 360 “‹”‹Advanced…
-
Russia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025
Tags: apt, data, espionage, government, intelligence, malicious, military, monitoring, russia, spy, threat, ukraineRussia-linked APT UAC-0184 targets Ukrainian military and government bodies via Viber, delivering malicious ZIP files for espionage in 2025. Russia-linked threat actor UAC-0184 (aka Hive0156) is targeting Ukrainian military and government entities, using Viber messages to deliver malicious ZIP files as part of ongoing intelligence-gathering operations in 2025. >>Recent monitoring data from the 360 “‹”‹Advanced…
-
Taiwan subjected to 2.6 million Chinese cyberattacks a day in 2025
This article originally appeared on ComputerSweden.More on cyberattacks:Cybersecurity firm turns tables on threat actors with decoy data trapIranian APT Prince of Persia returns with new malware and C2 infrastructure’Ink Dragon’ threat group targets IIS servers to build stealthy global network First seen on csoonline.com Jump to article: www.csoonline.com/article/4112834/taiwan-subjected-to-2-6-million-chinese-cyberattacks-a-day-in-2025.html
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 78
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Evasive Panda APT poisons DNS requests to deliver MgBot Spearphishing Campaign Abuses npm Registry to Target U.S. and Allied Manufacturing and Healthcare Organizations EmEditor Supply Chain Incident Details Disclosed: Distribution of Information-Stealing Malware Sweeps…
-
Breach Roundup: Clop Tied to Korean Air Vendor Breach
Also: China-Linked APT Hijack Updates, Condé Nast Data Leaked, La Poste Hit. This week, a Clop-linked vendor breach hit Korean Air, a China-linked APT hijacked software updates, a critical zero-day flaw remained unpatched, Condé Nast faced a data leak, La Poste was disrupted and Korean police extradited a malware operation suspect. First seen on govinfosecurity.com…
-
Sunken Ships: Will Orgs Learn From Ivanti EPMM Attacks?
The April/May zero-day exploitations of Ivanti’s mobile device management platform meant unprecedented pwning of thousands of orgs by a Chinese APT, and history will probably repeat itself. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/sunken-ships-ivanti-epmm-attacks
-
NSFOCUS Monthly APT Insights November 2025
Regional APT Threat Situation In November 2025, the global threat hunting system of Fuying Lab detected a total of 28 APT attack activities. These activities were primarily concentrated in regions including South Asia and East Asia, with a smaller portion also found in Eastern Europe and Middle East. Some organizations remain unattributed to known APT…The…
-
Chinese Hackers Deploy Rootkit to Stealthily Mask ToneShell Malware
Tags: apt, backdoor, china, cyber, cyberespionage, government, group, hacker, malicious, malware, technology, toolA sophisticated cyberespionage campaign leveraging kernel-mode rootkit technology has been discovered targeting government organizations across Southeast and East Asia, with Myanmar and Thailand bearing the brunt of attacks. Security researchers identified a malicious driver delivering the ToneShell backdoor, a hallmark tool of the Chinese-nexus HoneyMyte APT group, also tracked as Mustang Panda or Bronze President.…
-
Mustang Panda deploys ToneShell via signed kernel-mode rootkit driver
China-linked APT Mustang Panda used a signed kernel-mode rootkit driver to load shellcode and deploy its ToneShell backdoor. China-linked APT Mustang Panda (aka Hive0154, HoneyMyte, Camaro Dragon, RedDelta or Bronze President) was observed using a signed kernel-mode rootkit driver with embedded shellcode to deploy its ToneShell backdoor. Mustang Panda has been active since at least 2012, targeting American and European entities such as…
-
Evasive Panda cyberespionage campaign uses DNS poisoning to install MgBot backdoor
China-linked APT Evasive Panda used DNS poisoning to deliver the MgBot backdoor in targeted cyber-espionage attacks in Türkiye, China, and India. Kaspersky researchers spotted the China-linked APT group Evasive Panda (aka Daggerfly, Bronze Highland, and StormBamboo) running a targeted cyber-espionage campaign using DNS poisoning to deliver the MgBot backdoor against victims in Türkiye, China, and…
-
SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 77
Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Choose Your Fighter: A New Stage in the Evolution of Android SMS Stealers in Uzbekistan From Linear to Complex: An Upgrade in RansomHouse Encryption Prince of Persia: A Decade of Iranian Nation-State APT Campaign…
-
Evasive Panda APT: Malware Delivery via AitM and DNS Poisoning
Evasive Panda, a sophisticated threat actor known by the aliases Bronze Highland, Daggerfly, and StormBamboo, has escalated its offensive capabilities through a two-year campaign that has deployed advanced attack techniques,, including adversary-in-the-middle (AitM) attacks and DNS poisoning. According to June 2025 research, the group maintained persistent operations between November 2022 and November 2024, targeting victims…
-
APT-36 Uses Fake >>WhatsApp Fraud<< Advisory to Hack Government Systems
The post APT-36 Uses Fake >>WhatsApp Fraud
-
Iranian >>Prince of Persia<< APT Resurfaces with Telegram-Controlled Stealth Malware
The post Iranian >>Prince of Persia
-
SideWinder APT Launches Cyberattacks on Indian Entities Posing as the Income Tax Department
Zscaler Threat Hunting has identified a sophisticated espionage campaign targeting Indian entities through fraudulent >>Income Tax Department
-
âš¡ Weekly Recap: Firewall Exploits, AI Data Theft, Android Hacks, APT Attacks, Insider Leaks & More
Cyber threats last week showed how attackers no longer need big hacks to cause big damage. They’re going after the everyday tools we trust most, firewalls, browser add-ons, and even smart TVs, turning small cracks into serious breaches.The real danger now isn’t just one major attack, but hundreds of quiet ones using the software and…
-
Infy Returns: Iran-linked hacking group shows renewed activity
Researchers report renewed activity by Iran-linked Infy (Prince of Persia), showing the hacking group remains active and dangerous after years of silence. SafeBreach researchers have spotted renewed activity from the Iran-linked APT group Infy, also known as Prince of Persia, nearly five years after its last known campaigns in Europe. SafeBreach warns the group remains…
-
Iranian Infy APT Resurfaces with New Malware Activity After Years of Silence
Threat hunters have discerned new activity associated with an Iranian threat actor known as Infy (aka Prince of Persia), nearly five years after the hacking group was observed targeting victims in Sweden, the Netherlands, and Turkey.”The scale of Prince of Persia’s activity is more significant than we originally anticipated,” Tomer Bar, vice president of security…
-
Iranian APT Prince of Persia returns with new malware and C2 infrastructure
A shift to Telegram: More recently, the researchers identified a new Tonnerre variant that’s advertised as v50, as well as an unknown new Foudre version that goes along with it. These versions use a new C2 server structure and, most importantly, can download a file from the server that enables Telegram communication via its API.The…
-
Iranian APT Targeting Networks and Critical Infrastructure Organizations
Iranian state-sponsored threat actors, previously thought to have gone dormant, have resurfaced with sophisticated new malware campaigns targeting critical infrastructure organizations globally. A new research report released by SafeBreach Labs reveals that the >>Prince of Persia
-
LongNosedGoblin Caught Snooping on Asian Governments
New China-aligned APT group is deploying Group Policy to sniff through government networks across Southeast Asia and Japan. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/longnosedgoblin-caught-snooping-on-asian-governments
-
China-linked APT UAT-9686 is targeting Cisco Secure Email Gateway and Secure Email and Web Manager
Cisco disclosed a critical zero-day (CVE-2025-20393) in Secure Email Gateway and Secure Email and Web Manager, actively exploited by a China-linked group. Cisco disclosed a critical zero-day, tracked as CVE-2025-20393, in Secure Email Gateway and Secure Email/Web Manager, which is actively exploited by a China-linked threat group. Cisco reported a December 10 campaign targeting certain…
-
Cisco customers hit by fresh wave of zero-day attacks from China-linked APT
Cisco has yet to release a patch for the actively exploited vulnerability, and attacks have been underway since at least late November. First seen on cyberscoop.com Jump to article: cyberscoop.com/cisco-zero-day-attacks-china-apt/
-
Iranian APT ‘Prince of Persia’ Resurfaces With New Tools and Targets
SafeBreach reports the resurgence of the Iranian APT group Prince of Persia (Infy). Discover how these state-sponsored hackers are now using Telegram bots and Thunder and Lightning malware to target victims globally across Europe, India, and Canada. First seen on hackread.com Jump to article: hackread.com/iran-apt-prince-of-persia-resurfaces/
-
Iranian APT ‘Prince of Persia’ Resurfaces With New Tools and Targets
SafeBreach reports the resurgence of the Iranian APT group Prince of Persia (Infy). Discover how these state-sponsored hackers are now using Telegram bots and Thunder and Lightning malware to target victims globally across Europe, India, and Canada. First seen on hackread.com Jump to article: hackread.com/iran-apt-prince-of-persia-resurfaces/
-
Dormant Iran APT is Still Alive, Spying on Dissidents
Prince of Persia has rewritten the rules of persistence with advanced operational security and cryptographic communication with its command-and-control server. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/iran-apt-spying-dissidents
-
Dormant Iran APT is Still Alive, Spying on Dissidents
Prince of Persia has rewritten the rules of persistence with advanced operational security and cryptographic communication with its command-and-control server. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/iran-apt-spying-dissidents
-
Academic Ambush: How the Forum Troll APT Hijacks Scholars’ Systems via Fake Plagiarism Reports
Tags: aptThe post Academic Ambush: How the Forum Troll APT Hijacks Scholars’ Systems via Fake Plagiarism Reports appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/academic-ambush-how-the-forum-troll-apt-hijacks-scholars-systems-via-fake-plagiarism-reports/
-
Blurred Deception: Russian APT Targets Transnistria and NATO with High-Pressure Phishing Lures
The post Blurred Deception: Russian APT Targets Transnistria and NATO with High-Pressure Phishing Lures appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/blurred-deception-russian-apt-targets-transnistria-and-nato-with-high-pressure-phishing-lures/