Tag: apt
-
Chinesische APT-Gruppe Camaro Dragon nutzt Nahost-Konflikt für Malware-Kampagne gegen Katar aus
Check Point Research (CPR), die Sicherheitsforschungsabteilung von Check Point Software Technologies hat eine Malware-Kampagne beobachtet, die sich an Ziele in Katar richtet und Foto-Archive mit Bildern aus dem Konflikt in Nahost als Lockmittel nutzt, um Malware einzuschleusen. Kurz nach Beginn der Angriffe am 1. März beobachtete CPR gezielte, mutmaßlich per E-Mail durchgeführte Kampagnen gegen Einrichtungen…
-
Russia-linked APT uses DRILLAPP backdoor to spy on Ukrainian targets
Russia-linked threat actors target Ukrainian entities with DRILLAPP backdoor and use Edge debugging for stealth. A new DRILLAPP backdoor campaign targets Ukrainian organizations, abusing Microsoft Edge debugging to evade detection. Observed in February 2026, it shows links to previous Russian-aligned operations by Laundry Bear APT group (aka UAC-0190, Void Blizzard) using the PLUGGYAPE malware family…
-
Konni Hijacks KakaoTalk Accounts in Spear-Phishing Malware Campaign
Konni APT recently ran a multi-stage malware operation that hijacked KakaoTalk accounts to spread remote access trojans (RATs) through highly targeted spear”‘phishing.”‹ The message used contextual content aligned with the victim’s role to build trust and trick them into opening an attached archive. That archive contained a malicious LNK shortcut masquerading as a document; once…
-
Iran MOIS Colludes With Criminals to Boost Cyberattacks
Iranian APTs have long pretended to be cybercriminal groups. Now they’re working with actual cybercriminal groups. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/iran-mois-criminals-cyberattacks
-
Iranian APT Hack Targets US Airport Bank and Software Company
Critical infrastructure organizations continue to face sustained pressure from nation-state cyber operations. Airports, financial institutions, and software companies represent high-value targets because of the operational and economic disruption that a successful intrusion can create. New reporting from SecurityWeek details how an Iranian advanced persistent threat group conducted cyber intrusions against organizations, including a U.S. airport,…
-
Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX
The post Exploiting the Crisis: Chinese APTs Weaponize Middle East Tensions to Target Qatar with PlugX appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/exploiting-the-crisis-chinese-apts-weaponize-middle-east-tensions-to-target-qatar-with-plugx/
-
Chinese APT Campaign Uses Middle East Lures to Target Qatar With PlugX
Chinese state-linked cyber espionage groups are actively exploiting geopolitical tensions in the Middle East to target organizations in Qatar, according to new findings. The campaign began almost immediately after the recent escalation in the region, highlighting how quickly advanced persistent threat (APT) groups adapt to real-world events to conduct cyber operations. Researchers from Check Point…
-
My Really Fun RSA 2026 Presentations!
Tags: ai, apt, automation, cyber, cybersecurity, data, detection, google, governance, guide, lessons-learned, malware, soc, strategy, threatThis blog is perhaps a little bit more like an ad, so if you don’t want to check the ads, consider not reading it. a very cyber image (Gemini) But this year at RSA 2026, I’m speaking on three topics: securing AI, using AI for SOC, and sharing lessons about how Google applies AI and other technologies…
-
Iran-Linked Hackers Target U.S. Critical Infrastructure Amid Rising Cyber Threats
Iran-linked threat actors are escalating cyber operations against U.S. and allied networks, with Seedworm recently deploying new backdoors against critical infrastructure and high-value organizations amid the current regional conflict. Activity associated with the Iranian APT group Seedworm (aka MuddyWater, Temp Zagros, Static Kitten) has been observed on the networks of multiple U.S. organizations since early…
-
Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor
The post Torrent of Threats: China-Nexus APT UAT-9244 Hijacks South American Telecoms with PeerTime Backdoor appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/torrent-of-threats-china-nexus-apt-uat-9244-hijacks-south-american-telecoms-with-peertime-backdoor/
-
Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive
The post Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/escalation-in-the-shadows-iranian-apt-seedworm-deploys-dindoor-backdoor-in-new-cyberoffensive/
-
Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations
Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits. Broadcom’s Symantec Threat Hunter Team uncovered a campaign by the Iran-linked MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) APT group targeting several U.S. organizations. >>Activity associated with Iranian APT group Seedworm has been spotted on the networks of multiple…
-
North Korean APTs Use AI to Enhance IT Worker Scams
DPRK worker scams are old hat, but they’re still working, thanks to AI tools that help with everything from face swapping to daily emails. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/north-korean-apts-ai-it-worker-scams
-
Iran-linked APT targets US critical sectors with new backdoors
An Iran-linked hacking group has been active inside the networks of several US organizations since early February, raising concerns that the activity could precede broader … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/06/seedworm-muddywater-backdoors-victims/
-
Iran-nexus APT Dust Specter targets Iraq officials with new malware
A campaign by Iran-linked group Dust Specter is targeting Iraqi officials with phishing emails delivering new malware families. Zscaler ThreatLabz researchers linked the Iran-nexus group Dust Specter to a campaign targeting Iraqi government officials. Threat actors impersonated the country’s Ministry of Foreign Affairs in phishing messages that delivered previously unseen malware, including SPLITDROP, TWINTASK, TWINTALK,…
-
Russian APT targets Ukraine with BadPaw and MeowMeow malware
Researchers uncovered a Russian campaign targeting Ukrainian entities with new malware families BadPaw and MeowMeow delivered through phishing emails. Researchers reported a phishing campaign linked to Russia that targets Ukrainian organizations using two new malware families, BadPaw and MeowMeow. The attack chain begins with a phishing email carrying a link to a ZIP archive. When…
-
Nation-State Hackers Play the Vibes
Who Knew APT Hackers Liked Emojis So Much?. All the nation-state hackers are vibe coding. Vibeware won’t win any coding awards. It’s not pretty. It doesn’t target any zero-day vulnerabilities or known flaws in innovative new ways – but it does allow polyglot malware to be generated at scale. First seen on govinfosecurity.com Jump to…
-
Spionagekampagne gegen Südkorea Angriff missbraucht Microsoft VS Code für Spionage
First seen on security-insider.de Jump to article: www.security-insider.de/apt-angriff-vs-code-spionage-suedkorea-dprk-a-72b28bd8c65fb0d7f3021b27ce2ab586/
-
Unmasking Silver Dragon: The Chinese-Nexus APT Haunting Southeast Asia and Europe
The post Unmasking Silver Dragon: The Chinese-Nexus APT Haunting Southeast Asia and Europe appeared first on Daily CyberSecurity. First seen on securityonline.info Jump to article: securityonline.info/unmasking-silver-dragon-the-chinese-nexus-apt-haunting-southeast-asia-and-europe/
-
Iranian hacktivists muster their forces but state APTs lay low
Hacktivist activity surrounding the Iran war is sky-high but Iran’s state-backed cyber espionage actors have yet to show their hands, giving security teams a valuable window of time to shore up their defences. First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639722/Iranian-hacktivists-muster-their-forces-but-state-APTs-lay-low
-
Indian APT ‘Sloppy Lemming’ Targets Defense, Critical Infrastructure
India-nexus cyber threat actors are growing more active and sophisticated, using custom tools coded in Rust and cloud-based command and control. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/india-apt-sloppy-lemming-defense-critical-infrastructure
-
From phishing to Google Drive C2: Silver Dragon expands APT41 playbook
APT group Silver Dragon, linked to APT41, targets governments via server exploits and phishing, using Cobalt Strike and Google Drive for C2. Check Point researchers have identified Silver Dragon, an APT group tied to the China-linked group APT41, targeting government entities in Europe and Southeast Asia since mid-2024. The group gains initial access by exploiting…
-
Iran”‘Linked “Dust Specter” APT Deploys AI”‘Aided Malware Against Iraqi Officials
Iran”‘nexus APT group “Dust Specter” is targeting Iraqi government officials with AI”‘assisted custom .NET malware, using dual attack chains that blend DLL sideloading, in”‘memory PowerShell, and ClickFix”‘style lures. In January 2026, Zscaler ThreatLabz tracked a new campaign against Iraqi officials in which the actor impersonated Iraq’s Ministry of Foreign Affairs and abused compromised government infrastructure…
-
Iranian APT Groups Intensify Cyberattacks on Critical Infrastructure Amid Rising Geopolitical Tensions
A dramatic escalation in Middle Eastern tensions began last week with Operation Lion’s Roar, a joint U.S.-Israeli military strike on Iranian nuclear and military sites. Iran retaliated with missiles and drones, disrupting energy, air travel, and diplomatic stability across the Gulf. Amid this kinetic conflict, Iranian state-affiliated advanced persistent threats (APTs) have ramped up cyber…
-
Silver Dragon APT Group Exploits Google Drive for Covert Attacks on Europe, Asia
Silver Dragon is a Chinese”‘aligned APT group that has been targeting public sector and high”‘profile organizations in Europe and Southeast Asia since at least mid”‘2024, with strong operational overlap to APT41 tradecraft. The group combines classic post”‘exploitation tooling like Cobalt Strike with new custom malware that abuses Google Drive as a covert command”‘and”‘control (C2) channel.research.…
-
Epic Fury introduces new layer of enterprise risk
Tags: access, apt, attack, business, cisa, ciso, communications, country, credentials, cyber, cybersecurity, data-breach, disinformation, exploit, group, infrastructure, intelligence, international, Internet, iran, malware, middle-east, network, ransomware, resilience, risk, rust, service, software, technology, tool, ukrainePhysical attacks on US-linked locations through direct action or partner groups. We are already seeing Iranian missile launches into a variety of nations in the region.Cyber operations that include disruptive activity, targeted intrusions, credential and access harvesting, destructive malware deployment, and the use of compromised infrastructure to support broader influence or operational objectives.Proxy networks across…