Tag: group
-
An iPhone-hacking toolkit used by Russian spies likely came from US military contractor
Google found a series of hacking tools they said were used by a Russian espionage group and a cybercriminal group in China. Sources from a U.S. government defense contractor said some of those hacking tools were theirs. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/
-
APT28 conducts long-term espionage on Ukrainian forces using custom malware
APT28 used BEARDSHELL and COVENANT malware to spy on Ukrainian military personnel, enabling long-term surveillance since April 2024. The Russia-linked group APT28 (aka UAC-0001, aka Fancy Bear, Pawn Storm, Sofacy Group, Sednit, BlueDelta, and STRONTIUM) has used BEARDSHELL and COVENANT malware to conduct long-term surveillance of Ukrainian military personnel. According to ESET, the campaign began in April 2024 and relies on…
-
Fake LinkedIn Interview Used by Lazarus Hackers to Target AllSecure CEO
Researchers at AllSecure have revealed how North Korean hackers from the Lazarus Group used a fake LinkedIn job interview and deepfake technology to target their CEO. First seen on hackread.com Jump to article: hackread.com/fake-linkedin-interview-lazarus-hackers-allsecure-ceo/
-
Russian military hackers revive advanced malware to spy on Ukraine, researchers say
Russian state hacker group APT28 has revived a sophisticated cyber-espionage toolkit to spy on Ukrainian targets, including military personnel, according to a report published Tuesday by cybersecurity firm ESET. First seen on therecord.media Jump to article: therecord.media/russia-apt-28-revives-malware-to-spy-on-ukraine
-
APT28 Uses BEARDSHELL and COVENANT Malware to Spy on Ukrainian Military
The Russian state-sponsored hacking group tracked as APT28 has been observed using a pair of implants dubbed BEARDSHELL and COVENANT to facilitate long”‘term surveillance of Ukrainian military personnel.The two malware families have been put to use since April 2024, ESET said in a new report shared with The Hacker News.APT28, also tracked as Blue Athena,…
-
APT28 hackers deploy customized variant of Covenant open-source tool
The Russian state-sponsored APT28 threat group is using a custom variant of the open-source Covenant post-exploitation framework for long-term espionage operations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/apt28-hackers-deploy-customized-variant-of-covenant-open-source-tool/
-
ShinyHunters Targets Hundreds of Websites in New Salesforce Campaign
Prolific ShinyHunters group claims to have stolen data from nearly 400 websites in Experience Cloud attacks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/shinyhunters-hundreds-websites/
-
Why access decisions are becoming the weakest link in identity security
Tags: access, ai, api, attack, authentication, automation, breach, business, ciso, control, credentials, data, finance, governance, group, iam, identity, least-privilege, login, okta, radius, risk, saas, service, technology, toolThe SSO fallacy: Why authentication is not a guarantee: I’m often asked by business and technology leaders, “If we have SSO enabled, why do we still need to worry about granular access controls?” The underlying assumption is that once a user is authenticated through a central, secure portal, the hard work is done.In practice, SSO…
-
Zero Day: Unternehmen sind das neue Hauptziel
Die Google Threat Intelligence Group (GTIG) hat ihren jährlichen Zero-Day-Bericht veröffentlicht: Sie hat im Jahr 2025 insgesamt 90 Zero-Day-Sicherheitslücken identifiziert, die in freier Wildbahn ausgenutzt wurden. Obwohl diese Zahl niedriger ist als der Rekordwert von 2023 (100), liegt sie deutlich über der Zahl von 2024 (78). Insgesamt scheint sich die jährliche Anzahl in dem Bereich……
-
Chinese APT Campaign Uses Middle East Lures to Target Qatar With PlugX
Chinese state-linked cyber espionage groups are actively exploiting geopolitical tensions in the Middle East to target organizations in Qatar, according to new findings. The campaign began almost immediately after the recent escalation in the region, highlighting how quickly advanced persistent threat (APT) groups adapt to real-world events to conduct cyber operations. Researchers from Check Point…
-
Hackers Use Microsoft Teams to Manipulate Employees Into Allowing Remote Access
A newly discovered malware operation is targeting employees at finance and healthcare organizations by posing as internal IT support. Once inside, the attackers deploy a stealthy new tool called the A0Backdoor. Cybersecurity researchers at BlueVoyant have identified a threat group, known as Blitz Brigantine or Storm-1811, using email bombing and Microsoft Teams messages to trick…
-
An iPhone-hacking toolkit used by Russian spies likely came from U.S military contractor
Google found a series of hacking tools they said were used by a Russian espionage group and a cybercriminal group in China. Sources from a U.S. government defense contractor said some of those hacking tools were theirs. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/
-
Salt Typhoon is hacking the world’s phone and internet giants, here’s everywhere that’s been hit
Salt Typhoon is by far one of the most prolific hacking groups in recent years, breaching some of the top American phone companies. Here are all the countries that have been targeted. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/09/salt-typhoon-china-who-has-been-hacked-global-telecom-giants/
-
Pro-Iranian Hacktivists Join Nation-State Groups in Targeting U.S., Israel, Others
More than 60 hacktivist groups, armed with AI, mobilized within hours of the U.S. and Israel first striking Iran, adding another element to an already active and expanding cyberthreat environment that includes dozens of known Iranian nation-state groups. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/pro-iranian-hacktivists-join-nation-state-groups-in-targeting-u-s-israel-others/
-
9th March Threat Intelligence Report
AkzoNobel, a Netherlands-based global paint manufacturer, has confirmed a cyberattack affecting one of its United States sites. The company said the intrusion was contained, while the Anubis ransomware group claimed it stole […] First seen on research.checkpoint.com Jump to article: research.checkpoint.com/2026/9th-march-threat-intelligence-report/
-
Salt Typhoon is hacking the world’s phone and internet giants. Here’s everywhere that’s been hit.
Salt Typhoon is by far one of the most prolific hacking groups in recent years, breaching some of the top American phone companies. Here are all the countries that have been targeted. First seen on techcrunch.com Jump to article: techcrunch.com/2026/03/09/salt-typhoon-china-who-has-been-hacked-global-telecom-giants/
-
Iran internet blackout reaches 6th day as rights groups call for end to digital shutdown
The internet shutdown in Iran entered its sixth day on Friday, with human rights groups calling on the country’s leaders to restore digital access. First seen on therecord.media Jump to article: therecord.media/iran-internet-outage-israel-war
-
APT36 unleashes AI-generated ‘vibeware’ to flood targets
The Pakistani threat group has been using AI to rewrite malicious code across multiple programming languages, prioritising scale over sophistication to evade detection, security researchers have found First seen on computerweekly.com Jump to article: www.computerweekly.com/news/366639830/APT36-unleashes-AI-generated-vibeware-to-flood-targets
-
Cognizant’s TriZetto Provider Solutions data breach impacted over 3.4 million patients
A breach at Cognizant’s TriZetto Provider Solutions exposed sensitive health data belonging to more than 3.4 million patients. A data breach at Cognizant’s TriZetto Provider Solutions exposed sensitive information belonging to more than 3.4 million patients. At this time, no ransomware group has claimed responsibility for the attack yet. TriZetto Provider Solutions is a healthcare…
-
Iran-Linked Hackers Target U.S. Critical Infrastructure Amid Rising Cyber Threats
Iran-linked threat actors are escalating cyber operations against U.S. and allied networks, with Seedworm recently deploying new backdoors against critical infrastructure and high-value organizations amid the current regional conflict. Activity associated with the Iranian APT group Seedworm (aka MuddyWater, Temp Zagros, Static Kitten) has been observed on the networks of multiple U.S. organizations since early…
-
Cyber Espionage Group CL-UNK-1068 Linked to China Targets Asian Infrastructure
Tags: china, cyber, espionage, government, group, infrastructure, law, malware, open-source, technology, threatA highly sophisticated cyber espionage group, designated as CL-UNK-1068, has been actively targeting critical infrastructure across South, Southeast, and East Asia since at least 2020. Originating from China, the threat actors focus on high-value sectors, including aviation, energy, government, law enforcement, technology, and telecommunications. The attackers use a versatile mix of custom malware, open-source utilities,…
-
Cybercrime Group in Vietnam Enables Massive Fraudulent Signups
A wave of fraudulent account registrations to a cybercrime ecosystem operating out of Vietnam. These fake accounts are not just spam; they underpin large-scale financial fraud, phishing, and interpersonal scams that erode trust in online platforms. Attackers scripted mass “puppet” signups on victim services, triggered SMS messages to premium-rate numbers, and then monetized the telecom…
-
Web Server Exploits and Mimikatz Used in Attacks Targeting Asian Critical Infrastructure
High-value organizations located in South, Southeast, and East Asia have been targeted by a Chinese threat actor as part of a years-long campaign.The activity, which has targeted aviation, energy, government, law enforcement, pharmaceutical, technology, and telecommunications sectors, has been attributed by Palo Alto Networks Unit 42 to a previously undocumented threat activity group dubbed First…
-
Transparent Tribe’s ‘Vibeware’ Move Points to AI-Made Malware at Scale
Transparent Tribe (APT36) is moving from traditional, off”‘the”‘shelf tools to an AI-assisted malware model researchers now call “vibeware,” signaling how large language models are starting to industrialize mediocre but relentless attacks at scale.”‹ In its latest campaigns against Indian government bodies, embassies and regional targets, the group has shifted to an AI-driven development pipeline that…
-
AI Is Moving Faster Than Security Controls
Tags: access, ai, api, automation, computing, control, cybersecurity, data, governance, group, intelligence, monitoring, risk, service, software, technology, tool, updateAI is entering organisations faster than the security controls designed to govern it. Artificial intelligence is rapidly becoming embedded across organisations. AI assistants are now writing code, summarising documents, analysing data, and supporting operational decisions. What began as experimentation is quickly becoming operational dependency. For security teams, the challenge is not simply adopting AI. The…
-
China-Linked Hackers Use Malware Trio for Telecom Espionage
Tags: access, china, cisco, communications, cyberespionage, espionage, group, hacker, infrastructure, malware, tool, usaResearchers Tie UAT-9244 Intrusion to Famous Sparrow and Tropic Trooper. A China-linked cyberespionage group has been targeting telecommunications providers in South America since 2024 using a set of newly discovered malware tools designed to maintain persistent access to critical communications infrastructure, Cisco Talos researchers found. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/china-linked-hackers-use-malware-trio-for-telecom-espionage-a-30940
-
FBI is Investigating the ‘Sophisticated’ Hack of Its Surveillance System
The FBI, CISA, and NSA reportedly are investigating the hack by an unnamed “sophisticated” actor of a FBI surveillance system that holds sensitive information. The breach carries the hallmarks of Chinese nation-state groups and comes amid concerns about attacks in the wake of the war against Iran and the shrinking of the federal cybersecurity apparatus.…
-
Iran-linked MuddyWater deploys Dindoor malware against U.S. organizations
Iran-linked APT MuddyWater targeted U.S. organizations, deploying the new Dindoor backdoor across sectors including banks, airports, and nonprofits. Broadcom’s Symantec Threat Hunter Team uncovered a campaign by the Iran-linked MuddyWater (aka SeedWorm, TEMP.Zagros, Mango Sandstorm, TA450, and Static Kitten) APT group targeting several U.S. organizations. >>Activity associated with Iranian APT group Seedworm has been spotted on the networks of multiple…