Stories tagged “Cyber Espionage.”
23 stories
Lazarus Group is tied to exploitation of a newly patched Windows flaw to deliver a new backdoor against defense and aerospace targets. Check Point says the campaign uses recruiter lures, malicious PDFs, and compromised infrastructure.
A fake browser update served over hijacked hotel Wi-Fi has been used to deliver CornFlake, a remote access trojan (RAT) that can capture webcam images, microphone audio, and keystrokes, Microsoft said in its latest report.
Kaspersky attributes a fresh wave of attacks across the Middle East, Africa, and South Asia to Iranian group Nimbus Manticore, which deployed a new Windows backdoor called NightLedger alongside custom WebSocket tunnelers BridgeHead and ArcBridge to covertly relay traffic …
A Russia-aligned threat group, UAC-0099, is using a malicious Notepad++ plugin to compromise Windows systems, delivering the MATCHBOIL.V2 malware via sophisticated phishing campaigns.
Russian intelligence services are hacking internet-connected security cameras across Europe and Ukraine to spy on military logistics, weapons shipments, and Ukrainian troops. The cameras are often left exposed with default passwords and outdated firmware, making them vuln…
Cybersecurity researchers have discovered a previously undocumented malware called GoSerpent that has been put to use in cyber attacks targeting entities in Southeast Asia since late 2025 with a focus on long-term access and intelligence gathering.
The European Union has imposed sanctions on Russian military officers, hackers and private companies, denouncing what it called a years-long cyber-espionage campaign against the bloc.
Researchers at Shandong University demonstrate a new covert channel that can leak data from air-gapped systems using video cable emissions.
Mustang Panda, a China-aligned espionage group, is using Zoho WorkDrive as a command channel in attacks on the Indian government and hydropower targets. The group is deploying new malware and abusing the legitimate cloud service to pass commands and exfiltrate data.
Ukraine's Security Service uncovered a campaign by Russian intelligence to steal messaging credentials via fake support texts. The goal is to gain access to sensitive information.
A Chinese-speaking APT actor has been linked to a new custom backdoor called TinyRCT, targeting government entities and critical infrastructure in Southeast Asia. The threat actor, known as CL-STA-1062, has been attributed to previous campaigns in East Asia since March 2022.
Google's Threat Intelligence Group has detailed a new .NET backdoor called STOCKSTAY, used by Russian state-sponsored threat actor Turla in Ukraine espionage attacks. The backdoor has been deployed against government and military organizations in Ukraine and entities inte…
Canada's spy agency used a first-of-its-kind warrant to clean botnet-infected devices, including servers, routers, and IoT gear. The warrant allowed the agency to alter, degrade, and destroy botnet data on infected machines.
China-linked SprySOCKS backdoor expands to Windows with driver-based stealth, allowing for more sophisticated cyber espionage attacks.
Attackers are exploiting critical vulnerabilities in Fortinet's FortiSandbox platform. Fortinet released security updates for these flaws on April 14.
Chinese hackers exploited Google Workspace rules to steal sensitive research and defense emails from North American medical, academic, and military research networks. The attackers used a backdoor on REDCap research servers to gain access and then rewired the victims' Goo…
OceanLotus Hits Vietnam Investors With SPECTRALVIPER in FireAnt Attack
ESET says OceanLotus used a FireAnt Metakit supply chain attack and a separate intrusion to push SPECTRALVIPER onto Vietnamese targets.
Russia-aligned groups are still abusing a WinRAR flaw to infect Ukrainian organizations with stealers, even after the patch shipped in July 2025.
Volexity says China-linked VerdantBamboo used a BSD variant of BRICKSTORM and other implants to hit Linux appliances, a victim's M365, and an MSP firewall. The group leaned on stolen credentials and appliance abuse to stay hidden.
UNC5221 used Brickstorm, Plenet, and AgentPSD to stay inside victim networks for months and keep re-entry options open.
Attackers stayed inside a stock exchange executive’s Outlook mailbox for at least five months, exporting mail in small batches through Dropbox and OneDrive.
Gamaredon is abusing a WinRAR flaw to launch a malware chain that delivers a worm and an info-stealer against Ukrainian targets.
New Russian-Linked GREYVIBE Targets Ukraine with AI-Powered Cyberattacks
WithSecure says GREYVIBE has been hitting Ukraine since at least August 2025 using phishing, fake sites, and AI-assisted tooling. The group appears to sit between cybercrime and state-linked activity.