espionage news
23 stories
Antino Backdoor Lets China-Linked UAT-11587 Turn Microsoft 365 Into a C2 Channel
Cisco Talos researchers have identified a new Rust-based backdoor, dubbed Antino, which a China-linked threat actor known as UAT-11587 is using to conduct espionage against government and policy organizations in Asia. The backdoor uniquely leverages Microsoft 365 services, specifically Outlook and OneDrive, for its command-and-control (C2) communications, allowing its traffic to blend in with…
Russian hackers Star Blizzard expand targeting, change up tactics to reach Ukraine and beyond
A Russian government-backed hacking group, identified by Microsoft as Star Blizzard and affiliated with the Federal Security Service (FSB), has significantly expanded its targeting and refined its attack methods. The group, also known as SEABORGIUM, Callisto Group, TA446, and COLDRIVER, has shifted from highly targeted spear-phishing to larger-scale phishing campaigns, impacting over 100…
Russia's Star Blizzard Targets 100+ Organizations With Fake Event Invites to Deliver Backdoor
Russian state-sponsored hacking group, Star Blizzard, has reportedly targeted over 100 organizations with sophisticated phishing campaigns designed to deliver backdoor malware. The attacks, which commenced in January, leverage fake event invitations to deceive recipients into installing a backdoor known as CosmicPulse on Windows systems. The primary targets of these campaigns are organizations…
Philippine Nuclear and Naval Targets Hit by Suspected Chinese Operator
A suspected Chinese-speaking threat actor has reportedly breached a Philippine nuclear research body and a marine engineering company that provides services to the Philippine Navy, exploiting known vulnerabilities in internet-facing systems to exfiltrate sensitive data. The activity was uncovered by Hunt.io Attack Capture, which identified an exposed server in Amsterdam containing attack…
U.S. Sanctions Iran-Linked Hackers Behind Critical Infrastructure Breaches
The U.S. Department of the Treasury has reportedly imposed sanctions on approximately 60 Iran-linked entities and individuals. Among those sanctioned is a cyber group that is reportedly affiliated with Iran's Ministry of Intelligence and Security (MOIS). This group is accused of conducting widespread breaches targeting U.S. critical infrastructure, alongside engaging in financially motivated…
Pro-Ukraine Hackers Claim Attack on Russian Network Monitoring Firm
Russian software developer Microolap has confirmed a cyberattack on some of its systems, though it disputes the extent of the breach claimed by a pro-Ukraine hacking group. The company, which specializes in network traffic interception and analysis software, stated on Thursday that it detected an attempted intrusion into several non-critical systems. However, Microolap denied that attackers…
Fake Conferences, OAuth and WhatsApp: Inside Russia’s New Espionage Tactics
Google's Threat Intelligence Group (GTIG) has identified three distinct Russia-linked cyber espionage clusters, designated UNC6293, UNC7005, and UNC5976, which are targeting researchers, academics, government officials, think-tank analysts, and defense sector personnel in Europe and the United States. These groups employ persistent and adaptive phishing campaigns, leveraging sophisticated…
ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More
This week's cybersecurity reporting highlights a diverse array of threats and developments, including the exploitation of legitimate signed drivers for malicious kernel operations, a significant cyber espionage campaign attributed to an Iran-based threat actor targeting academic institutions, and the proliferation of malware leveraging DLL sideloading techniques. The landscape also includes…
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
A recent report indicates that the Lazarus Group, a North Korean state-sponsored hacking collective, has been exploiting a Windows zero-day vulnerability to achieve SYSTEM-level access and deploy a new backdoor. This activity is part of a broader cyber espionage campaign known as Operation Dream Job. The campaign specifically targets defense and aerospace companies across several countries.
Hijacked Hotel Wi-Fi Pushes Fake Updates to Deliver Surveillance Malware
Reports indicate that a sophisticated threat actor, identified as Storm-2945 and reportedly associated with Russia's SVR, has been observed compromising hotel Wi-Fi networks to facilitate the distribution of surveillance malware. The operation, codenamed CaptiveCrunch, involves redirecting unsuspecting users to deceptive update pages, where they are then prompted to download a remote access…
Russian Espionage Group Exploited Zimbra Zero-Day to Steal Mail and 2FA Codes
A Russian espionage group has reportedly exploited a zero-day vulnerability in the Zimbra Collaboration webmail client to steal sensitive user data, including emails and two-factor authentication codes. The campaign, attributed to the group TA488 (also known as LAUNDRY BEAR or Void Blizzard), began as early as July 2025 and continued for several months until the vulnerability was patched in…
Hackers abuse ViPNet software to target Russian govt agencies
An advanced persistent threat (APT) group has been observed exploiting the update mechanism of the ViPNet private networking suite to target Russian government agencies and other organizations. The campaign, dubbed "HelloNet" by researchers, has been active since at least May, deploying a multi-stage malware payload that establishes persistence and acts as a loader for additional malicious…
China-Linked Daxin Malware Active on Manufacturer's Network Since 2013
Researchers have identified the China-linked Daxin rootkit and a previously unknown backdoor, dubbed Stupig, active on the network of a Taiwan-based subsidiary of a multinational high-tech manufacturer. The discovery suggests a highly stealthy intrusion that may have persisted undetected for 13 years, with compilation timestamps on both malware artifacts dating back to early 2013.
Iran Tracks US Military Phones, macOS Malware, Data Breaches
Recent reports indicate a multi-faceted threat landscape, with Iran reportedly engaging in tracking the mobile phones of U.S. military personnel. This intelligence surfaces alongside the emergence of a new macOS malware variant named CrashStealer. Further incidents include identified vulnerabilities in OpenClaw AI agents, a ransomware attack targeting the naval defense firm TKMS, and a data…
MassTraction Exploits Roundcube Flaws at US, Canadian Universities
A threat group identified as UNK_MassTraction, suspected of operating on behalf of China, has been observed exploiting vulnerabilities within the Roundcube webmail application. The primary targets of these attacks are research mail servers located at academic institutions in both the United States and Canada. The group's reported method involves the theft of user sessions to achieve…
Suspected Chinese Threat Group Targets Universities via Vulnerable Roundcube Servers
A suspected China-aligned threat group, tracked by researchers as UNK_MassTraction, has been actively exploiting vulnerabilities in Roundcube webmail servers to gain access to academic institutions in the United States and Canada. The primary targets appear to be physics and engineering departments, with potential connections to national security interests.
Suspected Chinese espionage group used a Roundcube exploit chain to burrow into universities
China-aligned attackers have targeted U.S. and Canadian universities, exploiting a chain of vulnerabilities in the Roundcube webmail client to gain unauthorized access to sensitive data and establish persistent footholds within academic networks. The campaign, observed by Proofpoint researchers since May, appears to be ongoing and has primarily focused on physics and engineering departments,…
'BusySnake' Infostealer Slithers Into Critical Infrastructure Networks
A sophisticated information-stealing malware dubbed 'BusySnake' has been detected actively targeting critical infrastructure sectors. Threat actors operating under the moniker 'Armored Likho' have reportedly achieved successful infiltrations into government and electrical power organizations located in Russia, Brazil, and Kazakhstan.
Cavern Manticore: Exposing Iran-Linked Modular C2 Framework
Check Point Research (CPR) has identified a sophisticated modular command-and-control (C2) framework named 'Cavern Manticore,' linked to an Iran-nexus threat actor. This group primarily targets Israeli organizations, with a particular focus on government entities and the IT sector. Cavern Manticore exhibits technical similarities to other Iran-linked groups, including MuddyWater and Lyceum,…
Iran-Nexus TAG-182 Disseminates MarkiRAT Surveillance Tool
A cyber-espionage group identified as TAG-182, believed to be operating on behalf of the Iranian government, is actively distributing a surveillance tool known as MarkiRAT. This malware is being disseminated through fake applications designed to mimic legitimate services like VPNs and media players, with the apparent aim of collecting intelligence on Iranian targets both within and outside the…
Gamaredon Group Evolves Tactics With New Tools and Alliances
The Russia-aligned advanced persistent threat (APT) group Gamaredon, also known as UAC-0010, maintained a high operational tempo throughout 2025, primarily targeting governmental and military institutions in Ukraine. The group, which the Security Service of Ukraine (SSU) attributes to the 18th Center of Information Security of Russia's FSB, significantly evolved its tactics, tools, and…
NCSC CEO: Hostile states linked to three-quarters of cyber attacks affecting UK's critical systems
The head of the UK's National Cyber Security Centre (NCSC) has stated that approximately three-quarters of cyber attacks targeting the nation's critical infrastructure over the past year have been linked to hostile state actors. Dr. Richard Horne, CEO of the NCSC, revealed this figure during a speech at the Royal United Services Institute's (RUSI) Annual Security Lecture.
Gamaredon Facilitated Turla's Access to Ukrainian Targets
ESET researchers have uncovered evidence of collaboration between the Gamaredon and Turla espionage groups, with Gamaredon actively enabling Turla's access to Ukrainian targets. Between February and June 2025, Gamaredon's tools were used to deploy Turla's Kazuar backdoor and restore access. This partnership highlights a division of labor where one group establishes access and the other deploys advanced espionage tools.