Tag: cyberespionage
-
After helping Russia on the ground North Korea targets Ukraine with cyberespionage
Tags: credentials, cyber, cyberespionage, email, government, hacker, identity, intelligence, korea, microsoft, north-korea, phishing, resilience, risk, russia, ukraineCredential harvesting: Before the phishing emails, the same Ukrainian government entities were targeted with email alerts impersonating Microsoft and claiming unusual sign-in activity was detected on their accounts. The victims were asked to perform identity verification by clicking on a button, which took them to credential harvesting pages.The Proofpoint researchers didn’t manage to obtain any…
-
Government webmail hacked via XSS bugs in global spy campaign
Hackers are running a worldwide cyberespionage campaign dubbed ‘RoundPress,’ leveraging zero-day and n-day flaws in webmail servers to steal email from high-value government organizations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/government-webmail-hacked-via-xss-bugs-in-global-spy-campaign/
-
Russian Hackers Exploit XSS Vulnerabilities to Inject Malicious Code into Email Servers
Tags: blizzard, cyber, cyberespionage, cybersecurity, email, exploit, group, hacker, malicious, russia, vulnerability, xssA sophisticated cyberespionage campaign, dubbed Operation RoundPress, has been uncovered by cybersecurity researchers at ESET. Attributed with medium confidence to the Russian-linked Sednit group-also known as APT28, Fancy Bear, and Forest Blizzard-this operation targets high-value webmail servers using cross-site scripting (XSS) vulnerabilities. Active since at least 2004, Sednit has a notorious history, including alleged involvement…
-
Turkish Group Hacks Zero-Day Flaw to Spy on Kurdish Forces
Tags: credentials, cyberespionage, exploit, flaw, group, malware, microsoft, military, mitigation, spy, theft, zero-dayMicrosoft Researchers Link Turkish Spy Group to Output Messenger Zero-Day Hack. A Turkish-linked cyberespionage group known as Marbled Dust exploited a zero-day in the Output Messenger Server Manager application to spy on Kurdish military operations in Iraq. Microsoft reported the hack and called for immediate mitigation to block credential theft and malware delivery. First seen…
-
Output Messenger zero-day leveraged in ongoing cyberespionage campaign
First seen on scworld.com Jump to article: www.scworld.com/brief/output-messenger-zero-day-leveraged-in-ongoing-cyberespionage-campaign
-
North Korea Targets Ukraine With Cyberespionage Operations
Tags: cyber, cyberespionage, cybersecurity, hacker, intelligence, korea, north-korea, phishing, risk, ukrainePhishing Campaigns Appear to Be Solely Intelligence-Gathering for DPRK Leadership. North Korea nation-state hackers appear to have entered the Ukrainian cyber operations fray, albeit solely for cyberespionage purposes for gathering intelligence to help North Korean leadership determine the current risk to its forces already in the theater, cybersecurity researchers report. First seen on govinfosecurity.com Jump…
-
Output Messenger flaw exploited as zero-day in espionage attacks
A Türkiye-backed cyberespionage group exploited a zero-day vulnerability to attack Output Messenger users linked to the Kurdish military in Iraq. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/output-messenger-flaw-exploited-as-zero-day-in-espionage-attacks/
-
Russia-linked ColdRiver used LostKeys malware in recent attacks
Tags: apt, attack, cyberespionage, espionage, google, government, group, intelligence, malware, russia, threatSince early 2025, Russia-linked ColdRiver has used LostKeys malware to steal files in espionage attacks on Western governments and organizations. Google’s Threat Intelligence Group discovered LOSTKEYS, a new malware used by Russia-linked APT COLDRIVER, in recent attacks to steal files and gather system info. TheColdRiverAPT (aka “Seaborgium”, “Callisto”, “Star Blizzard”,”TA446″) is a Russian cyberespionage group…
-
Iranian Hackers Posing as Model Agency to Target Victims
Unit 42, the threat intelligence arm of Palo Alto Networks, has exposed a covert operation likely orchestrated by Iranian cyber actors. The campaign involves a fraudulent website, megamodelstudio[.]com, meticulously designed to impersonate the Hamburg-based Mega Model Agency. Cyberespionage Campaign Uncovered Registered on February 18, 2025, and hosted at IP address 64.72.205[.]32 since March 1, 2025,…
-
NSO Group Ordered to Pay $168 Million to WhatsApp in US Spyware Verdict
A federal jury in California has ordered Israeli spyware maker NSO Group to pay approximately $168 million in damages to WhatsApp. The verdict, delivered on Tuesday, represents a pivotal victory in the ongoing global battle against commercial cyberespionage and sets a new precedent for the accountability of spyware vendors. The ruling concludes a six-year legal…
-
Iranian Hackers Breach Middle East Infrastructure
Tags: breach, credentials, cyberespionage, fortinet, group, hacker, infrastructure, iran, middle-east, network, technology, theft, threatFortinet Uncovers Long-Term Cyberespionage in Region. An Iranian state-sponsored threat group conducted a years-long cyberespionage campaign targeting a Middle East critical infrastructure provider, with its operational technology network a key target. The attackers focused reconnaissance activity and credential theft on the OT network. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/iranian-hackers-breach-middle-east-infrastructure-a-28284
-
SentinelOne warns of threat actors targeting its systems and high-value clients
SentinelOne warns China-linked APT group PurpleHaze attempted reconnaissance on its systems and high-value clients. Cybersecurity firm SentinelOne warns that a China-linked APT group, tracked as PurpleHaze, attempted to conduct reconnaissance on its infrastructure and high-value clients. The activity suggests targeted cyberespionage efforts aimed at gathering information for potential future attacks. SentinelOne first identified PurpleHaze’s activity…
-
Enterprise-specific zero-day exploits on the rise, Google warns
Tags: access, apple, apt, attack, china, cisco, cloud, crime, crimes, cyberespionage, detection, endpoint, exploit, finance, flaw, google, group, Hardware, incident response, injection, Internet, ivanti, korea, lessons-learned, mandiant, microsoft, mitigation, network, north-korea, remote-code-execution, russia, service, strategy, technology, threat, tool, update, vpn, vulnerability, zero-daySurge in network edge device exploitation: Of the 33 zero-day vulnerabilities in enterprise-specific products, 20 targeted hardware appliances typically located at the network edge, such as VPNs, security gateways, and firewalls. Notable targets last year included Ivanti Cloud Services Appliance, Palo Alto Networks’ PAN-OS, Cisco Adaptive Security Appliance, and Ivanti Connect Secure VPN.Targeted attacks against…
-
Earth Kurma APT Targets Southeast Asia with Stealthy Cyberespionage
In a newly released report, Trend Research has unveiled the operations of an advanced persistent threat (APT) group, First seen on securityonline.info Jump to article: securityonline.info/earth-kurma-apt-targets-southeast-asia-with-stealthy-cyberespionage/
-
China-linked BRICKSTORM backdoor involved in Europe-targeted cyberespionage
First seen on scworld.com Jump to article: www.scworld.com/brief/china-linked-brickstorm-backdoor-involved-in-europe-targeted-cyberespionage
-
Breach Roundup: Cyber Insurance Market Set to Double by 2030
Also, a ‘Perfect Tool’ for Cyberespionage and EU Stocks Up on Burner Phones. This week, the cyber insurance market could double, Europe to use burner phones in the U.S., a BPFDoor campaign, Alcasec faces Spanish prison, a Thai harassment campaign and charges in Taiwan for a Chinese captain. China stonewalled a Swedish cable cutting investigation.…
-
Zwei Tools – eine Mission: UNC5174 startet raffinierte Angriffskampagne
Der Hintergrund der Angriffe legt nahe, dass die Aktivitäten sowohl der Cyberspionage als auch dem Zugangshandel an kompromittierten Netzwerken dienen. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/zwei-tools-eine-mission-unc5174-startet-raffinierte-angriffskampagne/a40507/
-
New Russia-linked cyberespionage campaign abuses Windows RDP
First seen on scworld.com Jump to article: www.scworld.com/brief/new-russia-linked-cyberespionage-campaign-abuses-windows-rdp
-
Ukraine subjected to new cyberespionage campaign
First seen on scworld.com Jump to article: www.scworld.com/brief/ukraine-subjected-to-new-cyberespionage-campaign
-
Chinese Espionage Group Targeting Legacy Ivanti VPN Devices
More Evidence Surfaces of Chinese Hackers Targeting Ivanti Products. A suspected Chinese cyberespionage operation is behind a spate of malware left on VPN appliances made by Ivanti. The threat actor used a critical security vulnerability the Utah company patched in February. We are aware of a limited number of customers whose appliances have been exploited.…
-
CISA warns of latest Ivanti firewall bug being exploited by suspected Chinese hackers
Researchers attributed exploitation of the vulnerability to a suspected China-based cyberespionage group tracked as UNC5221. First seen on therecord.media Jump to article: therecord.media/cisa-ivanti-firewall-bug-exploitation
-
Asia-Pacific, Latin America subjected to Chinese cyberespionage attacks
First seen on scworld.com Jump to article: www.scworld.com/brief/asia-pacific-latin-america-subjected-to-chinese-cyberespionage-attacks
-
China’s FamousSparrow APT Hits Americas with SparrowDoor Malware
China-linked APT group FamousSparrow hits targets in the Americas using upgraded SparrowDoor malware in new cyberespionage campaign, ESET reports. First seen on hackread.com Jump to article: hackread.com/china-famoussparrow-apt-americas-sparrowdoor-malware/
-
Russia-linked Gamaredon targets Ukraine with Remcos RAT
Tags: apt, attack, cyberespionage, group, phishing, powershell, rat, russia, spear-phishing, ukraineRussia-linked Gamaredon targets Ukraine with a phishing campaign using troop-related lures to deploy the Remcos RAT via PowerShell downloader. Talos researchers warn that Russia-linked APT group Gamaredon (a.k.a. Armageddon, Primitive Bear, ACTINIUM, Callisto) targets Ukraine with a phishing campaign. The cyberespionage group is behind a long series of spear-phishing attacks targeting Ukrainian entities, and organizations related…
-
Cyberspionage in Russland – Aktiv ausgenutzter Zero-Day-Exploit in Google Chrome
First seen on security-insider.de Jump to article: www.security-insider.de/sicherheitsluecke-chrome-sandbox-umgehung-kaspersky-a-5cc1e2fae2e2dc9392ea2cf85b8cd384/
-
Chinese FamousSparrow hackers deploy upgraded malware in attacks
A China-linked cyberespionage group known as ‘FamousSparrow’ was observed using a new modular version of its signature backdoor ‘SparrowDoor’ against a US-based trade organization. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/chinese-famoussparrow-hackers-deploy-upgraded-malware-in-attacks/
-
Mercenary Hacking Group Appears to Embrace Ransomware
Highly Targeted Ransomware Hit Traced to Long-Running Cyberespionage Group. A stealthy group of mercenary hackers active since 2018 appears to have diversified into hitting hypervisors with ransomware via highly targeted attacks. Researchers said they tracked the hit to a corporate espionage team tracked as RedCurl. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/mercenary-hacking-group-appears-to-embrace-ransomware-a-27834