Sign in Subscribe

APT

Chinese APT Exploits Visual Studio Code to Target Southeast Asian Governments

Chinese APT Exploits Visual Studio Code to Target Southeast Asian Governments

On September 6, 2024, Unit 42 researchers released a report detailing a new cyber espionage campaign by the Chinese Advanced Persistent Threat (APT) group known as "Stately Taurus."

Tropic Trooper APT Expands into Middle Eastern Targets, Leveraging China Chopper Web Shell

Tropic Trooper APT Expands into Middle Eastern Targets, Leveraging China Chopper Web Shell

Traditionally known for targeting Taiwan, the Philippines, and Hong Kong entities. This recent campaign, however, represents a strategic expansion, as Tropic Trooper shifted its focus toward government entities in the Middle East, particularly those involved in human rights studies.

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

Russian Military Cyber Actors Target U.S. and Global Critical Infrastructure

A joint cybersecurity advisory detailing Russian cyber actors affiliated with the General Staff Main Intelligence Directorate (GRU) Unit 29155 targeting critical infrastructure worldwide.

Predator Spyware Infrastructure Resurfaces After US Sanctions

Predator Spyware Infrastructure Resurfaces After US Sanctions

Insikt Group released a report revealing the return of Intellexa's Predator spyware infrastructure. Despite US government sanctions and a significant decline in activity following public exposure in 2023, Predator has resurfaced with modifications aimed at evading detection.

Suspected Espionage Campaign Delivers "Voldemort" Malware Impersonating Tax Authorities

Suspected Espionage Campaign Delivers "Voldemort" Malware Impersonating Tax Authorities

Proofpoint released a threat insight report detailing an unusual campaign delivering custom malware named "Voldemort". Researchers assess with moderate confidence that the goal of this activity is espionage.

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits

State-backed attackers and commercial surveillance vendors repeatedly use the same exploits

These campaigns, targeting Mongolian government websites, involved the reuse of n-day exploits previously linked to commercial surveillance vendors (CSVs) Intellexa and NSO Group. The attackers, suspected to be Russian government-backed APT29.

Iranian State-Backed Group Deploys Custom Malware in Ongoing Intelligence Operations

Iranian State-Backed Group Deploys Custom Malware in Ongoing Intelligence Operations

The group targeted sectors including satellite, communications, oil and gas, as well as federal and state governments in the United States and the UAE between April and July 2024. This activity represents a significant evolution in Peach Sandstorm’s ongoing intelligence-gathering operations.