Tag: espionage
-
Chinese Intelligence Targeted NVIDIA CEO Jensen Huang in AI Chip Espionage Effort: Report
China’s primary intelligence service orchestrated an operation targeting NVIDIA Corp. CEO Jensen Huang, deploying an operative to cultivate access to the tech leader as Beijing sought to pierce U.S. export controls on advanced artificial intelligence (AI) semiconductors. According to intelligence accounts detailed in a New York Times report Friday, China’s Ministry of State Security (M.S.S.)..…
-
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found. First seen on therecord.media Jump to article: therecord.media/russia-hackers-smartphone-cyberattacks
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
China-Aligned Hackers Hijack Popular Sogou Keyboard Software to Secretly Install DarkVigil Malware
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China’s most widely used keyboard apps, to quietly install the DarkVigil implant on victims’ machines. ESET Research, which tracks the actor as SlippyNunchucks, published its findings on November 4, 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10.…
-
Russian Intel Hackers Troll Mobile Devices for Login Cookies
Tags: android, espionage, group, hacker, intelligence, login, mobile, russia, service, vulnerabilitySekoia Links Campaign to Russian Espionage Group Targeting iOS and Android Users. Russian state hackers used lookalike and compromised websites to conduct a watering hole campaign against mobile devices, using known vulnerabilities to snatch browser cookies and other data. Sekoia identifies with moderate to high confidence Russia’s Foreign Intelligence Service as the attacker. First seen…
-
AI agents scale and speed up Chinese-linked attacks
A China-nexus espionage group used AI agents to attack more than 200 organizations in 11 days, CrowdStrike said last week. On Monday, Kaspersky published details of a separate … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai/
-
PapRAT Cyber-Espionage Campaign Leaves a ‘Bitter’ Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
PapRAT Cyber-Espionage Campaign Leaves a ‘Bitter’ Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
PapRAT Cyber-Espionage Campaign Leaves a ‘Bitter’ Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
Agentic pen-testing tool employed in multiple espionage campaigns around the globe
Researchers have tracked the increased use of Artex and other frameworks in order to automate and speed up attack methods. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/agentic-pen-testing-tool-espionage-campaigns/873427/
-
DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026.According to a report published by Dream Research Labs, the campaign has led to the compromise of a high-profile individual in Israel, along with additional compromises affecting…
-
PapRAT Cyber Espionage Campaign Leaves a ‘BITTER’ Taste in South Asia
Organizations in the region face attacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains. First seen on darkreading.com Jump to article: www.darkreading.com/cyberattacks-data-breaches/paprat-cyberespionage-campaign-bitter-south-asia
-
Bitter Deploys PapRAT in Asian Cyber-Espionage Campaign
Bitter used three infection chains against South and Southeast Asian targets, one with no malware executable First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/paprat-bitter-cyberespionage/
-
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure.The activity, observed by Palo Alto Networks Unit 42 between October 2025 and April 2026, has been tracked under the moniker CL-UNK-1211, where “CL” refers to cluster and “UNK” stands for unknown First seen on…
-
Chinese Hackers Exploit VMware ESXi Zero-Day to Target Law Firms in Cyber Espionage Attacks
Chinese state-linked hackers have exploited a zero-day vulnerability in VMware ESXi during espionage operations aimed at U.S. law firms, according to CrowdStrike’s latest assessment of threats affecting the legal sector. The activity is attributed to WARP PANDA, a China-nexus adversary that deployed malware in victims’ VMware vCenter environments. This series of intrusions, which continued into…
-
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns
The China-nexus cyber espionage group known as Volt Typhoon has been attributed to a now-disrupted covert access network dubbed Silent Train that has been put to use for zero-day exploitation and strategic access.”First identified in late 2023, Silent Train uses rotating chains of compromised SOHO, IoT, and enterprise infrastructure,” Lumen Technologies Black Lotus Labs said…
-
Lazarus Abuses South Korean Security Software to Deploy Malware Using Post-Quantum Encryption
Tags: cyber, cybersecurity, encryption, espionage, group, kaspersky, korea, lazarus, malware, north-korea, russia, softwareThe North Korea-linked Lazarus Group has been attributed to a cyber espionage campaign dubbed Operation FlashHole targeting at least three organizations in South Korea spanning the construction, software, and wire-communication equipment manufacturing sectors.According to Russian cybersecurity company Kaspersky, the campaign has been active since at least July 2025. It’s assessed to pick up First seen…
-
BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot
A new UEFI bootkit named BlackX, deployed in an espionage campaign in early 2026, exploited the old Baton Drop vulnerability to bypass Secure Boot and load a malicious driver designed to interfere with security solutions from Kaspersky and Avast. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/blackx-uefi-bootkit-exploits-baton-drop-flaw-to-bypass-secure-boot/
-
Russia-linked hackers broke into NATO shipbuilder in latest espionage campaign
Symantec, which discovered the operation, urged companies to scan their networks for signs of compromise. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/russia-nato-hacking-shipbuilder-critical-infrastructure/833509/
-
Russian Hackers Steal Credentials and Open Secret SSH Tunnel Into NATO Defense Firm’s Network
Tags: blizzard, credentials, cyber, defense, espionage, government, group, hacker, intelligence, law, military, network, russiaSwallowtail, the Russian espionage group also tracked as APT28, Fancy Bear and Forest Blizzard, targeted organizations in two NATO member states, including a law enforcement agency, a naval shipbuilder and a manufacturer of military aircraft engines. The targets’ roles point to intelligence collection focused on national security and defense. The U.S. government identifies APT28 and…
-
Russian GRU hackers hit NATO shipbuilder, aircraft engine maker, law enforcement agency in espionage campaign
It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said. First seen on cyberscoop.com Jump to article: cyberscoop.com/russian-hackers-apt28-target-nato-defense-firms/
-
Prolific Chinese espionage group exploits BeyondTrust zero-day
Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers. First seen on cyberscoop.com Jump to article: cyberscoop.com/china-espionage-attacks-beyondtrust-zero-day-armory-castle/
-
China-nexus espionage actor targets BeyondTrust support tool in zero-day campaign
Researchers say the hacker is harvesting credentials and stealing sensitive information. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/china-espionage-beyondtrust-zero-day-hacker/833240/
-
Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day
An alleged Chinese state-backed group is using a new zero-day affecting BeyondTrust IT support software to conduct espionage attacks. First seen on therecord.media Jump to article: therecord.media/beyond-trust-cyberattack-china
-
China Espionage Actor Actively Targeting Critical BeyondTrust Flaw, Google Warns
The suspected PRC-aligned group Armory Castle has been observed exploiting the newly disclosed flaw for long-term persistence First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/china-actor-beyondtrust-flaw-google/
-
Hackers Exploit BeyondTrust Zero-Day and Erase Security Logs to Hide Their Tracks
A suspected China-nexus espionage group exploited a critical zero-day in BeyondTrust Remote Support, tracked as CVE-2026-102764. It then deleted logs to hide its activity. BeyondTrust patched the flaw in advisory BT26-05 and disclosed it on October 15, 2026, alongside a Mandiant analysis. BeyondTrust zero-day According to research published by BeyondTrust, the actor exploited the vulnerability…
-
China-Linked Hackers Exploited BeyondTrust Zero-Day to Take Over Remote Support Servers
The China-nexus cyber espionage group tracked as Armory Castle (previously UNC5221 or Warp Panda) exploited a newly disclosed security flaw in BeyondTrust Remote Support (formerly Bomgar) as a zero-day in late August 2026.The vulnerability, tracked as CVE-2026-102764 (CVSS score: 9.3), is a case of improper origin validation in an internal messaging component that could be…
-
Google Warns Chinese Hackers Exploited Critical BeyondTrust Zero-Day to Gain Root Access
A suspected China-linked espionage group exploited a critical BeyondTrust Remote Support vulnerability as a zero-day in late August 2026 weeks before BeyondTrust disclosed it on October 15. Mandiant, which investigated the incident, found the attackers used the flaw to upload a file, then built a path from an unprivileged web service account to root access,…
-
Silent Lynx: Kazakhstan-Linked Hackers Target Russian Refinery and Government
Silent Lynx, a group likely based in Kazakhstan, targets Russian energy and government entities in espionage campaigns across Central Asia. Researchers from Cisco Talos and Recorded Future published a detailed paper on a threat actor they call Silent Lynx (aka UAT-6275, TAG-193), a Kazakhstan nexus group conducting espionage across Central Asia. The targets include the…
-
Suspected Kazakhstan-linked hackers target governments across former Soviet states
A roughly 2-year-old cyber-espionage campaign against Central Asian states appears to originate in Kazakhstan, researchers said. First seen on therecord.media Jump to article: therecord.media/suspected-kazakhstan-phishing-central-asia-espionage