apt news
13 stories
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
Cisco Talos researchers have identified a new Rust-based backdoor, dubbed Antino, which a China-linked threat actor known as UAT-11587 is using to conduct espionage against government and policy organizations in Asia. The backdoor uniquely leverages Microsoft 365 services, specifically Outlook and OneDrive, for its command-and-control (C2) communications, allowing its traffic to blend in with…
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Reports indicate that a sophisticated threat actor, identified as Storm-2945 and reportedly associated with Russia's SVR, has been observed compromising hotel Wi-Fi networks to facilitate the distribution of surveillance malware. The operation, codenamed CaptiveCrunch, involves redirecting unsuspecting users to deceptive update pages, where they are then prompted to download a remote access…
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian espionage group has reportedly exploited a zero-day vulnerability in the Zimbra Collaboration webmail client to steal sensitive user data, including emails and two-factor authentication codes. The campaign, attributed to the group TA488 (also known as LAUNDRY BEAR or Void Blizzard), began as early as July 2025 and continued for several months until the vulnerability was patched in…
Hackers abuse ViPNet software to target Russian govt agencies
An advanced persistent threat (APT) group has been observed exploiting the update mechanism of the ViPNet private networking suite to target Russian government agencies and other organizations. The campaign, dubbed "HelloNet" by researchers, has been active since at least May, deploying a multi-stage malware payload that establishes persistence and acts as a loader for additional malicious…
Chinese APT Group Linked to DigiCert Breach and Code Signing Certificate Theft
A recent report indicates that a Chinese Advanced Persistent Threat (APT) group has been implicated in a security breach at DigiCert, leading to the theft of code-signing certificates. The group, identified by researchers under the monikers GoldenEyeDog and CylindricalCanine, is known for its previous targeting of sectors such as gambling and gaming.
China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors
Cybersecurity researchers have identified an expansion in the arsenal of a China-linked advanced persistent threat (APT) group, known for its operations under the name LapDogs. This threat actor has reportedly introduced new malware components, specifically focusing on compromising small office/home office (SOHO) routers. The newly identified backdoors have been named LongLeash, DogLeash, and…
China-Linked APT Expands Proxy Network With New Malware
A China-linked advanced persistent threat (APT) group, identified as UAT-7810, has been observed expanding its network of compromised devices, known as Operational Relay Box (ORB) networks, and equipping it with new custom malware. Researchers at Cisco Talos assessed with high confidence that UAT-7810 is a China-nexus group. These ORB networks consist of hijacked routers and other devices that…
Armored Likho Hits Government, Energy Sectors With BusySnake Stealer
A newly identified threat actor, referred to as Armored Likho, is actively targeting organizations within the government and energy sectors across Russia, Kazakhstan, and Brazil. Researchers have observed a sophisticated phishing campaign orchestrated by this group, which leverages a custom-developed information-stealing malware.
MassTraction Exploits Roundcube Flaws at US, Canadian Universities
A threat group identified as UNK_MassTraction, suspected of operating on behalf of China, has been observed exploiting vulnerabilities within the Roundcube webmail application. The primary targets of these attacks are research mail servers located at academic institutions in both the United States and Canada. The group's reported method involves the theft of user sessions to achieve…
Chinese hackers develop LONGLEASH malware to expand ORB network
Chinese threat actors, identified as UAT-7810, are actively developing and deploying new malware to enhance their Operational Relay Box (ORB) network. This network, previously documented as a secure relay infrastructure for other China-aligned advanced persistent threat groups, is being expanded by compromising internet-facing networking devices, with a particular focus on unpatched Ruckus…
Iran-Linked Hackers Using Modular C&C Framework in Cyberattacks
A cyberespionage group with suspected ties to Iran has been observed employing a flexible, modular command-and-control (C2) framework to conduct attacks. The group has focused its efforts on compromising information technology service providers as a means to gain access to more valuable targets, particularly those located in Israel.
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
Check Point Research (CPR) has identified a sophisticated modular command-and-control (C2) framework named 'Cavern Manticore,' linked to an Iran-nexus threat actor. This group primarily targets Israeli organizations, with a particular focus on government entities and the IT sector. Cavern Manticore exhibits technical similarities to other Iran-linked groups, including MuddyWater and Lyceum,…
Armored Likho digging a snake pit: inside the covert BusySnake Stealer campaign
A newly identified threat actor, dubbed Armored Likho, has been observed conducting targeted phishing campaigns against government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. This group, also referred to as Eagle Werewolf based on circumstantial evidence, employs a sophisticated toolkit that includes a previously undocumented information stealer named BusySnake…