Tag: apt

Iran”‘linked PLC attacks cause real”‘world disruption at critical US infra sites

Apr 8, 2026 2:52 PM

Tags: access, advisory, apt, attack, automation, ciso, control, cyber, group, healthcare, infrastructure, iran, switch, threat

A recurring Iranian playbook: The advisory linked the current campaign to a pattern of Iranian state-affiliated targeting of US industrial control systems. The authoring agencies have previously reported similar activity by CyberAv3ngers, affiliated with Iran’s Islamic Revolutionary Guard Corps Cyber Electronic Command, which compromised at least 75 Unitronics PLC devices across water, wastewater, and other…
NSFOCUS Monthly APT Insights February 2026

Apr 7, 2026 7:52 AM

Tags: apt, attack, cyber, group, network, threat

Regional APT Threat Situation In February 2026, the global threat hunting system of FUYING Lab detected a total of 21 APT attack activities. These activities were primarily concentrated in regions including South Asia, East Asia, and Central Asia, as shown in the figure below. Regarding the activity levels of different groups, the most active APT…The…
Chinesische APT nutzt CitrixDay – Salt Typhoon: Systematischer und verdeckter Angriff

Apr 6, 2026 12:51 PM

Tags: apt, citrix, cyberattack, zero-day

First seen on security-insider.de Jump to article: www.security-insider.de/salt-typhoon-systematischer-und-verdeckter-angriff-a-ce0e527281b7bb9a75b4623a5d628bb0/
Cisco fixes critical IMC auth bypass present in many products

Apr 3, 2026 11:52 PM

Tags: access, ai, api, apt, attack, authentication, cisco, computing, credentials, cybersecurity, dns, email, exploit, firewall, firmware, flaw, group, infrastructure, linux, malicious, monitoring, network, password, ransomware, risk, router, vulnerability, zero-day

[ Related: More Cisco news and insights ] The Cisco IMC is a baseboard management controller (BMC), a dedicated controller embedded into server motherboards with its own RAM and network interface that gives administrators monitoring and management capabilities as if they were physically connected to the server with a keyboard, monitor, and mouse (KVM). Because BMCs run…
Google links Axios npm supply chain attack to North Korea-linked APT UNC1069

Apr 1, 2026 5:29 PM

Tags: apt, attack, exploit, finance, google, group, korea, north-korea, supply-chain, threat

Google links the Axios npm supply chain attack to North Korean threat group UNC1069, targeting financial gain. Google has attributed the recent Axios npm supply chain compromise to a North Korean threat group tracked as UNC1069. The attack, aimed at financial gain, exploited the package to target developers and organizations relying on Axios. John Hultquist…
Operation »Epic Fury» und die digitale Reaktion

Apr 1, 2026 8:30 AM

Tags: apt, cybersecurity, iran, threat

Die geopolitische Cyberlage in Europa hat sich seit dem 28. Februar 2026 grundlegend verschärft. Mit der militärischen »Epic Fury«- Operation gegen den Iran hat sich eine latente Bedrohung zu einem aktiven Cyberkonflikt entwickelt. Währenddessen positionieren sich chinesische APT-Gruppen unbemerkt in kritischen Infrastrukturen. Die Cybersecurity-Expertinnen und Experten von InfoGuard berichten in ihrem quartalsweisen Threat Report,… First…
Iran Deploys ‘Pseudo-Ransomware,’ Revives Pay2Key Operations

Mar 31, 2026 7:30 PM

Tags: apt, cybercrime, iran, ransomware

Iranian APTs are blurring the lines between state-sponsored and cybercriminal activities to target high-impact US organizations. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/iran-pseudo-ransomware-pay2key-operations
Dark Web Market Lists Alleged 375TB Lockheed Martin Data for $600M

Mar 30, 2026 4:30 PM

Tags: apt, dark-web, data, group, threat

A dark web market known as Threat Market is listing 375TB of Lockheed Martin data, which it claims was provided by a group calling itself ‘APT Iran.’ First seen on hackread.com Jump to article: hackread.com/dark-web-market-375tb-lockheed-martin-data/
Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing wave

Mar 30, 2026 10:29 AM

Tags: apt, attack, email, exploit, group, iphone, malicious, phishing, russia, spear-phishing, threat

Russia-linked TA446 is using the DarkSword iOS exploit kit in targeted phishing campaigns to compromise iPhone users. Russia-linked APT group TA446 (aka SEABORGIUM, ColdRiver, Callisto, and Star Blizzard) is using the DarkSword exploit kit in targeted spear-phishing campaigns against iOS devices. The attacks rely on malicious emails to compromise iPhones, highlighting a growing threat from…
Russia-linked APT TA446 uses DarkSword exploit to target iPhone users in phishing wave

Mar 30, 2026 10:29 AM

Tags: apt, attack, email, exploit, group, iphone, malicious, phishing, russia, spear-phishing, threat

Russia-linked TA446 is using the DarkSword iOS exploit kit in targeted phishing campaigns to compromise iPhone users. Russia-linked APT group TA446 (aka SEABORGIUM, ColdRiver, Callisto, and Star Blizzard) is using the DarkSword exploit kit in targeted spear-phishing campaigns against iOS devices. The attacks rely on malicious emails to compromise iPhones, highlighting a growing threat from…
China-linked Red Menshen APT deploys stealthy BPFDoor implants in telecom networks

Mar 27, 2026 10:30 PM

Tags: apt, china, espionage, government, group, middle-east, network, spy, threat

China-linked Red Menshen APT group used stealthy BPFDoor implants in telecom networks to spy on government targets. Rapid7 Labs uncovered a China-linked threat group known as Red Menshen has been running a long-term espionage campaign by infiltrating telecom networks, mainly in the Middle East and Asia. Active since at least 2021, the group uses highly…
China Upgrades the Backdoor It Uses to Spy on Telcos Globally

Mar 27, 2026 10:30 PM

Tags: apt, backdoor, china, cybersecurity, malware, spy

Chinese APT Red Menshen’s super-advanced BPFdoor malware defeats traditional cybersecurity protections. All telcos can do, really, is try hunting it down. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-upgrades-backdoor-spy-telcos
Researchers release tool to detect stealthy BPFDoor implants in critical infrastructure networks

Mar 26, 2026 2:47 PM

Tags: apt, china, infrastructure, network, tool

Telecommunications providers around the world have been dealing with the burrowing efforts of the China-linked APTs for many years now. To help them identify hard-to-detect … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/26/telecom-bpfdoor-detection-script/
Silver Fox Tax Audit Phishing Campaign Shifts from RATs to Python Stealers

Mar 26, 2026 1:46 PM

Tags: apt, backdoor, china, cyber, cybercrime, exploit, group, intelligence, monitoring, phishing, rat, threat, vulnerability

Threat intelligence teams have tracked Silver Fox (also known as Void Arachne), a China-based intrusion set that sits at the intersection of financially motivated cybercrime and APT-style espionage. Originally associated with large-scale, profit-driven campaigns, the group has steadily adopted more advanced tradecraft, including modular backdoors, rootkits, and the exploitation of vulnerable drivers. TDR’s monitoring between…
The espionage reality: Your infrastructure is already in the collection path

Mar 20, 2026 9:10 AM

Tags: access, apt, attack, authentication, breach, ciso, cloud, country, cyber, data, detection, espionage, exploit, governance, government, group, identity, infrastructure, injection, insurance, intelligence, network, risk, risk-assessment, service, spyware, theft, threat, tool

Commercial spyware as an intelligence channel: Criminal operators deploying Predator, a spyware suite sold by the sanctioned Intellexa consortium, have been documented across more than a dozen countries. US sanctions haven’t slowed them down an iota. Their targets are not random: journalists, activists, politicians, human”‘rights defenders, government employees and contractors, and other high”‘value individuals. Why?…
The espionage reality: Your infrastructure is already in the collection path

Mar 20, 2026 9:10 AM

Tags: access, apt, attack, authentication, breach, ciso, cloud, country, cyber, data, detection, espionage, exploit, governance, government, group, identity, infrastructure, injection, insurance, intelligence, network, risk, risk-assessment, service, spyware, theft, threat, tool

Commercial spyware as an intelligence channel: Criminal operators deploying Predator, a spyware suite sold by the sanctioned Intellexa consortium, have been documented across more than a dozen countries. US sanctions haven’t slowed them down an iota. Their targets are not random: journalists, activists, politicians, human”‘rights defenders, government employees and contractors, and other high”‘value individuals. Why?…
Russian APT targets Ukraine via Zimbra XSS flaw CVE-2025-66376

Mar 19, 2026 5:10 PM

Tags: apt, cve, email, exploit, flaw, russia, threat, ukraine, vulnerability, xss

Russian APT exploits a critical XSS flaw in Zimbra, tracked as CVE-2025-66376, running scripts via HTML emails to target users in Ukraine. Russia-linked threat actor exploits a high-severity XSS vulnerability, tracked as CVE-2025-66376 (CVSS score of 7.2), in Zimbra Collaboration. Attackers exploited insufficiently sanitized HTML emails to run scripts when opened, targeting users in Ukraine.…
Iran-Linked Botnet Exposed After Open Directory Leak Reveals 15-Node Relay Network

Mar 19, 2026 9:10 AM

Tags: apt, botnet, cyber, data-breach, iran, leak, network, tool

A misconfigured open directory on an Iranian server has exposed a live censorship-bypass relay and SSH-based botnet operation, revealing how a single actor stitched together a 15-node network across Iran and Finland using commodity tools and sloppy operational security. The discovery shows how financially or personally motivated actors can reuse tradecraft seen in Iranian APT…
APT-Gruppe Camaro Dragon schlägt in Katar zu

Mar 18, 2026 8:09 AM

Tags: apt, cyberattack

Aktuelle Erkenntnisse von Check Point Research zeigen, wie eng Cyberangriffe inzwischen mit geopolitischen Entwicklungen verknüpft sind. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/apt-camaro-dragon-in-katar
APT-Gruppe Camaro Dragon schlägt in Katar zu

Mar 18, 2026 8:09 AM

Tags: apt, cyberattack

Aktuelle Erkenntnisse von Check Point Research zeigen, wie eng Cyberangriffe inzwischen mit geopolitischen Entwicklungen verknüpft sind. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/apt-camaro-dragon-in-katar
APT-Gruppe Camaro Dragon schlägt in Katar zu

Mar 18, 2026 8:09 AM

Tags: apt, cyberattack

Aktuelle Erkenntnisse von Check Point Research zeigen, wie eng Cyberangriffe inzwischen mit geopolitischen Entwicklungen verknüpft sind. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/apt-camaro-dragon-in-katar
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
Operation Epic Fury: Why exposure data changes everything about Iran’s cyber-kinetic campaign

Mar 18, 2026 5:10 AM

Tags: access, ai, api, apt, attack, backdoor, breach, cctv, cisa, cloud, country, cve, cvss, cyber, cybersecurity, data, data-breach, ddos, detection, dns, espionage, exploit, firewall, flaw, fortinet, government, group, healthcare, identity, infrastructure, intelligence, Internet, iot, iran, kev, malware, microsoft, military, network, office, phishing, radius, remote-code-execution, risk, strategy, supply-chain, technology, threat, unauthorized, update, vpn, vulnerability, warfare, windows

Iran’s retaliatory campaign following Operation Epic Fury has collapsed the boundary between physical and digital warfare. Tenable’s exposure data analysis across seven target countries reveals that the largest exploitable attack surface isn’t the headline threat, it’s a Microsoft Word N-day affecting nearly 14 million assets. Key takeaways: Exposure data rebalances the threat picture. A Microsoft…
FAQ on CVE-2026-21514: OLE bypass N-Day in Microsoft Word

Mar 18, 2026 5:10 AM

Tags: access, ai, apt, attack, awareness, backdoor, cctv, cisa, cloud, control, cve, cyber, cyberattack, data, data-breach, detection, email, endpoint, exploit, flaw, fortinet, google, government, group, healthcare, identity, infrastructure, intelligence, Internet, iran, kev, malicious, malware, microsoft, mitigation, network, office, phishing, remote-code-execution, risk, technology, theft, threat, training, unauthorized, update, vulnerability, windows, zero-day

An N-day vulnerability in Microsoft Word exposes nearly 14 million assets. Attackers can exploit this flaw to bypass security prompts, enabling deployment of malware and establishing persistent access without triggering user warnings. Key takeaways: CVE-2026-21514 is a Microsoft Word n-day that bypasses OLE and Mark-of-the-Web protections, executing payloads silently without triggering user security prompts Tenable’s…
Iranian Hackers Use Compromised Cameras for Regional Surveillance

Mar 17, 2026 3:10 PM

Tags: apt, cctv, cyber, exploit, group, hacker, infrastructure, intelligence, Internet, iran, middle-east

Iranian cyber actors are expanding operations targeting US organizations while also exploiting internet-connected cameras across the Middle East for intelligence collection and battlefield awareness. Recent incidents tied to APT group MuddyWater, camera”‘focused infrastructure, and hacktivist collective Handala point to an ecosystem that is operational but constrained, prioritizing persistence, visibility, and selective disruption over large”‘scale, coordinated cyber campaigns.…
CL1087 targets military capabilities since 2020

Mar 17, 2026 2:10 PM

Tags: apt, china, espionage, group, intelligence, military

China-linked APT group CL-STA-1087 has targeted Southeast Asian militaries since 2020 using AppleChris and MemFun. A suspected China-linked espionage campaign, tracked as CL-STA-1087, has targeted Southeast Asian military organizations since at least 2020, using AppleChris and MemFun malware. >>The activity demonstrated strategic operational patience and a focus on highly targeted intelligence collection, rather than bulk…
Chinesische APT-Gruppe Camaro Dragon nutzt Nahost-Konflikt für Malware-Kampagne gegen Katar aus

Mar 17, 2026 1:09 PM

Tags: apt, cyberattack, mail, malware, software

Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat eine Malware-Kampagne beobachtet, die sich an Ziele in Katar richtet und Foto-Archive mit Bildern aus dem Konflikt in Nahost als Lockmittel nutzt, um Malware einzuschleusen. Kurz nach Beginn der Angriffe am 1. März beobachtete CPR gezielte, mutmaßlich per E-Mail durchgeführte Kampagnen gegen Einrichtungen…
Russia-linked APT uses DRILLAPP backdoor to spy on Ukrainian targets

Mar 16, 2026 10:10 PM

Tags: apt, backdoor, group, malware, microsoft, russia, spy, threat, ukraine

Russia-linked threat actors target Ukrainian entities with DRILLAPP backdoor and use Edge debugging for stealth. A new DRILLAPP backdoor campaign targets Ukrainian organizations, abusing Microsoft Edge debugging to evade detection. Observed in February 2026, it shows links to previous Russian-aligned operations by Laundry Bear APT group (aka UAC-0190, Void Blizzard) using the PLUGGYAPE malware family…
Konni Hijacks KakaoTalk Accounts in Spear-Phishing Malware Campaign

Mar 16, 2026 8:09 AM

Tags: access, apt, cyber, malicious, malware, phishing, spear-phishing

Konni APT recently ran a multi-stage malware operation that hijacked KakaoTalk accounts to spread remote access trojans (RATs) through highly targeted spear”‘phishing.”‹ The message used contextual content aligned with the victim’s role to build trust and trick them into opening an attached archive. That archive contained a malicious LNK shortcut masquerading as a document; once…