APT

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware

APT, cybersecurity, Malware, News, Russian Federation, Threat Intelligence, Ukraine /

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware 2026-11-03 at 12:00 By Anamarija Pogorelec ESET has been tracking a Russia-aligned group it calls Gorbag, which has been breaking into Ukrainian organizations since at least February 2025 using spearphishing attachments and a stealer that erases itself once the data is gone. Spearphishing […]

Gorbag APT group hits Ukrainian courts and city councils with self-deleting malware Read More »

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network

0-day, APT, attack tools, Cisco, critical infrastructure, cyber espionage, Don't miss, enterprise, Fortinet, government-backed attacks, Hot stuff, Internet of Things, Lumen, News, telecommunications, USA /

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network 2026-10-29 at 15:42 By Zeljka Zorz Volt Typhoon, a Chinese state-sponsored APT group that’s focused on cyberespionage and United States’ critical infrastructure, has been using a covert, constantly rotating relay network to hide its most sensitive intrusions, Lumen’s Black Lotus Labs revealed on […]

Volt Typhoon targeted enterprise control planes via ever-changing “Silent Train” relay network Read More »

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016

APT, Featured, Infy, Iran, Malware & Threats, Nation-State, Prince of Persia /

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 2026-10-23 at 09:39 By Eduard Kovacs After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016. The post Iran’s Prince of Persia APT Hosts C&C in US for First […]

Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 Read More »

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks

APT, Malware & Threats, RedFlick, Russia, Star Blizzard /

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks 2026-09-30 at 13:59 By Ionut Arghire The state-sponsored group has launched larger-scale phishing campaigns to deploy the CosmicPulse backdoor. The post Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Read More »

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files

APT, attack tools, backdoor, cybersecurity, Don't miss, Hot stuff, Malware, News, PowerShell, research, Securonix, Threat Intelligence, Windows /

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files 2026-09-21 at 17:00 By Mirko Zorz Researchers have taken apart TASK#STOMP, a Windows backdoor that searches a victim’s drives for business documents, uploads them to attacker servers, and then stays put to grab each new or edited document. The same malware steals saved Wi-Fi […]

The TASK#STOMP Windows backdoor takes Wi-Fi passwords, screenshots, and business files Read More »

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316)

APT, Cisco, Don't miss, firewall, Hot stuff, News, Ransomware, vulnerability /

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) 2026-09-10 at 14:22 By Zeljka Zorz State-sponsored and financially-motivated attackers are actively exploiting CVE-2026-20079, a critical authentication bypass vulnerability in Cisco Secure Firewall Management Center (FMC), which is used for centrally managing multiple Cisco Secure Firewall devices across a network. Two FMC vulnerabilities under […]

Cisco FMC bugs exploited by nation-state and ransomware actors (CVE-2026-20079, CVE-2026-20316) Read More »

Fresh Windows Zero-Day Exploited in North Korean Cyberattacks

APT, exploited, Lazarus, North Korea, Vulnerabilities, Windows, Zero-Day /

Fresh Windows Zero-Day Exploited in North Korean Cyberattacks 2026-08-12 at 11:45 By Ionut Arghire The bug allowed attackers to gain full control of the victims’ systems and deploy the ForestTiger backdoor. The post Fresh Windows Zero-Day Exploited in North Korean Cyberattacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Fresh Windows Zero-Day Exploited in North Korean Cyberattacks Read More »

Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors

APT, cyber news, cybersecurity, Dark Web Monitoring, Europe, Ransomware, Ransomware Attacks, Ransomware Insights, Ransomware Threats, Threat Actors, Threat Intelligence, Threat Landscape Reports /

Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors 2026-08-07 at 13:58 By Mihir Bagwe Europe faced a ransomware onslaught in the first half of 2026 that sets a troubling precedent for the remainder of the year. According to Cyble Research and Intelligence Labs (CRIL), the region […]

Ransomware Threats in Europe H1 2026: A Deep Dive into Regional Attack Patterns and Dominant Threat Actors Read More »

Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking

APT, Microsoft, Midnight Blizzard, Mobile & Wireless, phishing, Russia, Wi-Fi /

Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking 2026-08-03 at 12:17 By Ionut Arghire Midnight Blizzard has been stealing Microsoft account credentials via compromised Wi-Fi networks at hospitality organizations. The post Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

Russian State APT Linked to Recent Public Wi-Fi Gateway Hacking Read More »

Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897)

APT, cyber espionage, Don't miss, government-backed attacks, Hot stuff, Microsoft Exchange, News, Proofpoint, Russian Federation, vulnerability /

Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897) 2026-07-30 at 17:23 By Zeljka Zorz Russia-affiliated cyber espionage group Laundry Bear (aka Void Blizzard, aka TA488) is exploiting CVE-2026-42897, a cross-site scripting vulnerability in Microsoft Exchange, to target US and European government entities and a variety of private sector organizations via email. The […]

Laundry Bear’s new Microsoft Exchange attack triggers on email open (CVE-2026-42897) Read More »

US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers

APT, critical infrastructure, Government, Nation-State, router, Russia /

US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers 2026-07-14 at 13:51 By Ionut Arghire Multiple state-sponsored APTs are compromising poorly secured devices across critical infrastructure sector networks. The post US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

US, Allies Warn of Russian Cyberattacks Targeting Critical Infrastructure Routers Read More »

Armored Likho APT Targeting Government, Electric Power Entities

APT, cybercrime /

Armored Likho APT Targeting Government, Electric Power Entities 2026-07-06 at 18:10 By Ionut Arghire The threat actor uses modular RATs and information stealers in financially motivated and cyber espionage campaigns. The post Armored Likho APT Targeting Government, Electric Power Entities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Armored Likho APT Targeting Government, Electric Power Entities Read More »

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets

APT, Malware, Malware & Threats, Russia, StockStay, Ukraine /

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets 2026-06-26 at 11:55 By Ionut Arghire Turla has been using the backdoor against government and military organizations in Ukraine for espionage. The post Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets Read More »

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262)

0-day, APT, CISA, Cisco, Don't miss, Hot stuff, News, SD-WAN /

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) 2026-06-16 at 13:20 By Zeljka Zorz Cisco has revealed another Catalyst SD-WAN Manager vulnerability (CVE-2026-20262) that its Product Security Incident Response Team observed being exploited by attackers. But the associated security advisory also states that “the vulnerability was found during internal security testing”, raising the […]

Cisco discloses second exploited SD-WAN vulnerability in two weeks (CVE-2026-20262) Read More »

China-linked spies backdoored authentication stack to stay hidden for years

APT, authentication, Don't miss, enterprise, Hot stuff, intrusion detection, Linux, News, remediation, Sygnia, threat hunting /

China-linked spies backdoored authentication stack to stay hidden for years 2026-06-15 at 18:27 By Zeljka Zorz A China-linked cyber espionage group known as Velvet Ant spent nearly a decade inside the internal network of an unnamed organization without being detected, according to the results of a forensic investigation published by cybersecurity firm Sygnia. The group’s […]

China-linked spies backdoored authentication stack to stay hidden for years Read More »

Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245)

0-day, APT, Cisco, Don't miss, exploit, Hot stuff, Mandiant, News, SD-WAN /

Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245) 2026-06-05 at 15:49 By Zeljka Zorz A 0-day privilege escalation vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager that has yet to be patched by Cisco is being leveraged by attackers. “To exploit this vulnerability, an attacker must have netadmin privileges on an affected system. This would require […]

Cisco SD-WAN 0-day exploited, no patch available (CVE-2026-20245) Read More »

Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns

APT, China, cybercrime, ESET, Iran, News, North Korea, report, Russian Federation, Ukraine /

Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns 2026-05-28 at 12:42 By Sinisa Markovic Geopolitical pressure drove much of the state-sponsored cyber activity recorded between October 2025 and March 2026, according to ESET’s latest APT Activity Report. Espionage groups aligned with China, North Korea, Russia, and Iran adjusted their […]

Oil shipments, drone makers, and a poisoned code library targeted in recent APT campaigns Read More »

Coinflow CISO on crypto payments security under AI pressure

APT, boardroom, CISO, communication, conferences, Crypto, cyber risk, cybercrime, cybersecurity, Don't miss, enterprise, Features, fraud, Hot stuff, News, opinion, Risk Management, Span, strategy, tips /

Coinflow CISO on crypto payments security under AI pressure 2026-05-27 at 09:24 By Mirko Zorz Crypto payment firms sit near the top of the target list for advanced persistent threat groups, and the workload on their security leaders keeps growing. Malcolm Portelli, CISO at Coinflow, runs the company’s security program from Malta. Coinflow is headquartered […]

Coinflow CISO on crypto payments security under AI pressure Read More »

Iranian APT Targets Aviation, Software Companies With Updated Tools

APT, APT35, Charming Kitten, Iran, Malware & Threats, Nimbus Manticore /

Iranian APT Targets Aviation, Software Companies With Updated Tools 2026-05-26 at 17:32 By Ionut Arghire Nimbus Manticore has continued its operations during and after the US military campaign against Iran. The post Iranian APT Targets Aviation, Software Companies With Updated Tools appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Iranian APT Targets Aviation, Software Companies With Updated Tools Read More »

Webworm APT targets European government organizations with new backdoors

APT, backdoor, ESET, Europe, Government, Hot stuff, News /

Webworm APT targets European government organizations with new backdoors 2026-05-20 at 17:48 By Anamarija Pogorelec ESET has released an analysis of the 2025 activity of Webworm, a China-aligned APT group tracked as Space Pirates and UAT-8302. Active since at least 2022, the group initially focused on targets in Asia, but has recently expanded its operations […]

Webworm APT targets European government organizations with new backdoors Read More »

Scroll to Top