Tag: cyberespionage
-
European-Chinese geopolitical issues drive renewed cyberespionage campaign
Proofpoint researchers say the group behind the surge, TA416, had turned away from Europe for a few years. First seen on cyberscoop.com Jump to article: cyberscoop.com/european-chinese-geopolitical-issues-drive-renewed-cyberespionage-campaign/
-
Hackers Deploy USB Malware, RATs, and Stealers in Southeast Asian Government Attacks
A multi-cluster cyberespionage operation in which attackers used USB-propagated malware, multiple RATs, loaders, and a custom stealer to target a Southeast Asian government organization between June and August 2025. Analysts initially observed USB-borne malware dubbed USBFect (also known as HIUPAN), which spreads through removable drives and deploys the PUBLOAD backdoor for lateral movement. Further telemetry revealed two…
-
CISA orders feds to patch DarkSword iOS flaws exploited attacks
CISA ordered U.S. government agencies to patch three iOS vulnerabilities targeted in cryptocurrency theft and cyberespionage attacks using the DarkSword exploit kit. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-darksword-ios-flaws-exploited-attacks/
-
Multi-Month Cyberespionage Campaign Hits Libyan Oil Refinery
Phishing Campaign Used AsyncRAT to Maintain Long-Term Network Access. A suspected cyberespionage campaign targeted a Libyan oil refinery using commodity malware and politically-themed phishing lures. The activity ran from November 2025 to mid-February, with evidence that attackers maintained long-term access to at least one oil company network. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/multi-month-cyberespionage-campaign-hits-libyan-oil-refinery-a-31091
-
‘TGR1030″ – Palo Alto Networks enttarnt neue Cyberspionage-Gruppe
First seen on security-insider.de Jump to article: www.security-insider.de/tgr-sta-1030-cyberspionage-phishing-gegen-regierungen-a-28542ad5a939f49fac74b55415301239/
-
‘TGR1030″ – Palo Alto Networks enttarnt neue Cyberspionage-Gruppe
First seen on security-insider.de Jump to article: www.security-insider.de/tgr-sta-1030-cyberspionage-phishing-gegen-regierungen-a-28542ad5a939f49fac74b55415301239/
-
‘TGR1030″ – Palo Alto Networks enttarnt neue Cyberspionage-Gruppe
First seen on security-insider.de Jump to article: www.security-insider.de/tgr-sta-1030-cyberspionage-phishing-gegen-regierungen-a-28542ad5a939f49fac74b55415301239/
-
Boggy Serpens Hits Diplomats, Critical Infrastructure in Espionage Waves
Boggy Serpens, also known as MuddyWater, has escalated its cyberespionage operations over the past year, focusing on diplomats and critical infrastructure organizations in a coordinated, multi-wave campaign. Boggy Serpens has moved beyond its earlier noisy, high-volume phishing style to prioritize persistence and stealth in campaigns across the Middle East, Europe, the Caucasus, Central and Western…
-
China-Nexus Hackers Skulk in Southeast Asian Military Orgs for Years
Researchers uncovered an extensive cyberespionage campaign that used novel backdoors and familiar evasion techniques to maintain persistent access to regional targets. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-nexus-hackers-southeast-asian-military-orgs
-
China Demands Proof After Costa Rica Blames UNC2814 for ICE Cyberattack
Tensions between China and Costa Rica have intensified following allegations tied to an ICE cyberattack that Costa Rican authorities say was linked to the cyberespionage group UNC2814. The dispute centers on a breach affecting Costa Rica’s state-run electricity and telecommunications provider and has quickly evolved from a domestic cybersecurity issue into a diplomatic disagreement involving competing narratives and…
-
Apple patches older iPhones and iPads against Coruna exploits
Apple has released security updates to patch older iPhones and iPads against a set of vulnerabilities targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-patches-older-iphones-and-ipads-against-coruna-exploits/
-
Finnish intelligence warns of persistent cyber espionage from Russia, China
Cyberespionage remains the country’s most significant digital threat, with attackers targeting government systems, research institutions and companies developing advanced technologies, according to a new intel report. First seen on therecord.media Jump to article: therecord.media/finnish-intel-warns-espionage-china-russia
-
China-Linked Hackers Use Malware Trio for Telecom Espionage
Tags: access, china, cisco, communications, cyberespionage, espionage, group, hacker, infrastructure, malware, tool, usaResearchers Tie UAT-9244 Intrusion to Famous Sparrow and Tropic Trooper. A China-linked cyberespionage group has been targeting telecommunications providers in South America since 2024 using a set of newly discovered malware tools designed to maintain persistent access to critical communications infrastructure, Cisco Talos researchers found. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-use-malware-trio-for-telecom-espionage-a-30940
-
CISA warns feds to patch iOS flaws exploited in crypto-theft attacks
CISA ordered U.S. federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-apple-flaws-exploited-in-spyware-crypto-theft-attacks/
-
CISA warns of Apple flaws exploited in spyware, crypto-theft attacks
CISA ordered U.S. federal agencies to patch three iOS security flaws targeted in cyberespionage and crypto-theft attacks using the Coruna exploit kit. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisa-warns-of-apple-flaws-exploited-in-spyware-crypto-theft-attacks/
-
Chinesische Cyberspionage-Gruppe Silver-Dragon hat Behörden in Europa und Asien im Visier
Die Sicherheitsforensiker von Check Point Research (CPR) haben eine Cyberspionage-kampagne identifiziert, die sich gegen Regierungs-organisationen in Südostasien und Teilen Europas richtet. CPR nennt die Gruppe ‘Silver Dragon>> und nach Einschätzung der Sicherheitsexperten ist sie seit mindestens Mitte 2024 aktiv. Die Kampagne kombiniert Server-Exploits, Phishing, maßgeschneiderte Malware und eine cloudbasierte Befehlsinfrastruktur, um langfristigen Zugriff auf die…
-
China’s Silver Dragon Razes Governments in EU, SE Asia
The emerging actor, part of the APT41 nexus, gains initial access via phishing, and uses legitimate network services to obscure cyberespionage activities. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/china-silver-dragon-governments-eu-se-asia
-
Amazon Says Drone Strikes Disrupted Middle East Data Centers
Iranian Cyberespionage Group MuddyWater Goes Dark. Physical effects rather than cyber strikes are triggering Middle Eastern connectivity problems during day four of a sustained U.S. and Israeli bombing campaign against Iran. Iran is responding with drone and missile attacks targeting U.S. military as well as British bases in Bahrain, Cyprus. First seen on govinfosecurity.com Jump…
-
Cyberspionage-Kampagne zielt auf staatliche Einrichtungen und kritische Infrastruktur
Arctic Wolf hat eine Cyberspionage-Kampagne aufgedeckt, die mit moderater Sicherheit <> (auch bekannt als Outrider Tiger und Fishing-Elephant) zugeschrieben werden kann. Ziel waren im Zeitraum von Januar 2025 bis Januar 2026 staatliche Einrichtungen und kritische Infrastruktur in Pakistan und Bangladesch. Die Kampagne stellt eine Weiterentwicklung der Aktivitäten dar, die erstmals im September 2024 von Cloudflare Cloudforce-One dokumentiert…
-
Suspected Chinese Cyberespionage Operation Hits 53 Telecoms
Google Unmasks, Disrupts Group Using Sheets for Command-and-Control Purposes. Likely Chinese nation-state hackers used online spreadsheets as infrastructure for hacking campaigns that affected at least 53 telecom operators across 42 countries, Google disclosed Wednesday. Incident responders discovered a backdoor being remotely controlled through Google Sheets. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/suspected-chinese-cyberespionage-operation-hits-53-telecoms-a-30857
-
Google disrupts Сhina-linked cyberespionage campaign spanning dozens of countries
A cyberespionage campaign carried out by a China-linked threat actor affected at least 53 government and telecom organizations across 42 countries, Google said. First seen on therecord.media Jump to article: therecord.media/china-cyber-espionage-google-disrupt
-
China-linked hackers used Google Sheets to spy on telecoms and governments across 42 countries
Tags: access, api, apt, china, cloud, communications, cyber, cyberespionage, data, defense, endpoint, espionage, google, government, group, hacker, infrastructure, intelligence, linux, mandiant, monitoring, network, phone, radius, service, spy, theft, threat, vpnHow Mandiant found it: The campaign came to light during a Mandiant Threat Defense investigation, when analysts flagged unusual activity on a CentOS server. A binary named xapt, designed to masquerade as the apt package manager on Debian-based Linux systems, had already escalated to root and was running shell commands to confirm its access level,…
-
China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769)
A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day flaw (CVE-2026-22769) in Dell’s RecoverPoint for Virtual Machines software since … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/02/18/exploited-dell-zero-day-cve-2026-22769-brickstorm-grimbolt/
-
Fresh Cyberespionage Operation Tied to Iranian Surveillance
Malware Campaign Uses Lures With Positive Portrayal of Anti-Tehran Protests. A new malware campaign is using a positive-sounding report into the recent protests in Iran, accompanied by real photos and videos, as lures in an apparent cyberespionage operation designed to conduct surveillance of dissident researchers and global communities, warn security researchers. First seen on govinfosecurity.com…
-
Norway Says Salt Typhoon Hackers Hit Vulnerable Systems
Security Service Says China-Linked Actor Compromised Vulnerable Network Devices. Norway’s security service confirmed it was targeted by the China-linked Salt Typhoon campaign, marking one of Europe’s clearest public acknowledgements that the cyberespionage operation extended beyond U.S. telecom and federal networks into allied infrastructure. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/norway-says-salt-typhoon-hackers-hit-vulnerable-systems-a-30721
-
Unit 42 meldet Aufdeckung weltweiter Cyberspionage-Kampagne gegen Regierungen
Tags: cyberespionageFirst seen on datensicherheit.de Jump to article: www.datensicherheit.de/unit-42-aufdeckung-weltweit-cyberspionage-kampagne-regierungen
-
State actor targets 155 countries in ‘Shadow Campaigns’ espionage op
A new state-aligned cyberespionage threat group tracked as TGR-STA-1030/UNC6619, has conducted a global-scale operation dubbed the “Shadow Campaigns,” where it targeted government infrastructure in 155 countries. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/state-actor-targets-155-countries-in-shadow-campaigns-espionage-op/
-
China’s Salt Typhoon hackers broke into Norwegian companies
Norway’s government accused China’s Salt Typhoon hacking group of conducting a cyberespionage campaign in the country. First seen on techcrunch.com Jump to article: techcrunch.com/2026/02/06/chinas-salt-typhoon-hackers-broke-into-norwegian-companies/
-
Threat Group Running Espionage Operations Against Dozens of Governments
Unit 42 researchers say an Asian threat group behind what they call the Shadow Campaigns has targeted government agencies in 37 countries in a wide-ranging global cyberespionage campaign that has involved phishing attacks and the exploitation of a more than a dozen known vulnerabilities. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/02/threat-group-running-espionage-operations-against-dozens-of-governments/