State-sponsored threat groups, APT campaigns, and geopolitical cyber operations.
North Korea's reliance on unsophisticated reply-baiting phishing against Ukrainians signals a critical intelligence shortfall regarding DPRK troops deployed …
The FBI's second takedown of Integrity Tech's hacking tools highlights a hard truth: infrastructure seizures disrupt but don't …
The FBI's latest domain seizures targeting Flax Typhoon reveal a persistent Chinese contractor model that rebuilds botnets faster …
The seizure of domains supporting MicroScan and FishHub reveals a modular Chinese attack chain combining vulnerability scanning, Mirai botnet amplification, and targeted data exfiltration. Critical infrastructure operators should …
Italy's Foreign Ministry weathered a cyberattack on October 8 while checking embassy sites for similar attempts. The incident fits the established pattern of pro-Russian hacktivist group NoName057(16), which …
A joint multi-agency advisory reveals Integrity Technology Group operated a portal distributing stolen email to unnamed third parties, blending state-linked espionage with commercial data brokering. The campaign targets …
Shield53 analysis: UAC-0099's continued refinement of its MatchBoil dropper underscores a persistent Russian espionage campaign targeting Ukrainian infrastructure. The group's operational tenacity and iterative malware development demand proactive …
UAC-0099's ASHVEIN malware demonstrates continued evolution of Russia-aligned initial access operations against Ukrainian government targets, with HTML-based command hiding and .NET tooling that complicates detection.
CISA's AA26-281A advisory details how China-linked threat actors enabled by Integrity Technology Group are chaining legacy CVEs with automated scanning and hands-on-keyboard techniques to compromise critical infrastructure. Organizations …
The U.S. bounty on alleged HAFNIUM operator Zhang Yu exposes China's use of private contractors as plausible deniability intermediaries. Shield53 analyzes the operational implications for defenders still dealing …
The State Department's $10 million bounty for Zhang Yu reveals how China's MSS uses corporate contractors to conduct espionage — and why the 2021 Exchange vulnerabilities remain a …
Rapid7's latest findings on BPFDoor and AVERAT variants show Red Menshen is refining its telecom-focused Linux implants to impersonate regional security products like SpamSniper, wrapping magic packets in …
TA419's patient cultivation of relationships with AI policy experts reveals a strategic intelligence shift — adversaries are now competing for influence over the governance frameworks that will shape …
MI5's September 30 alert naming the China General Technology Research Institute as an MSS proxy exposes how state intelligence services weaponize open academic collaboration. Over 100 UK researchers …
The extradition of alleged IRGC-linked hacker Amir Barati to the US underscores a decade-old campaign that exfiltrated 31TB from global universities. The Mabna Institute model — credential theft …
TA419's targeting of U.S. AI policy experts with Frameless BitB AitM phishing signals a deliberate intelligence push to understand—and potentially influence—the American regulatory landscape around frontier AI. Defenders …
MI5's unprecedented espionage alert exposing the China General Technology Research Institute as an MSS front reveals how state intelligence services weaponize legitimate academic partnerships. Universities and defense-adjacent organizations …
Cisco Talos uncovered a China-linked espionage group using Microsoft Graph API as a covert C2 channel via the Antino Rust backdoor. This represents a dangerous evolution in living-off-the-land …
A China-nexus APT is routing backdoor C2 traffic entirely through Microsoft Graph API using Outlook and OneDrive, making command channels nearly indistinguishable from legitimate business activity. Here's how …
The Pentagon's DMDC breach exposed 3 million military records over 9 months of undetected access. Shield53 examines the intelligence value of HR data and why traditional breach responses …
Shield53 analysis of Star Blizzard's RedFlick delivery technique: a modular, multi-stage infection chain leveraging VHDX, WebDAV, and scheduled tasks to deploy CosmicPulse with minimal user interaction. We break …
Russia's Star Blizzard has replaced its ClickFix social-engineering playbook with a new 'RedFlick' phishing technique aimed at NGOs, journalists, and think tanks tied to Ukraine. The continued evolution …
The DOJ indictment of Oxygen Forensics exposes a decade-long supply chain infiltration where Russian-owned forensic software silently embedded itself into US and EU law enforcement operations. This is …
Bitget's $387.5 million loss traces back to zero-day exploits in third-party security appliances — the very products meant to protect them. Shield53 examines the attack chain, the segmentation …
Russia's FSB-linked Star Blizzard has evolved from spear-phishing to scheduled-task-based backdoor delivery via compromised cPanel and WordPress infrastructure. Shield53 analyzes the operational significance of their RedFlick method and …
A newly identified China-linked malware framework targeting critical sectors emphasizes persistent access over immediate impact. Shield53 analyzes the strategic implications and what defenders should prioritize now.
North Korean actors bypassed Bitget's wallet authorization by compromising a critical backend system and spoofing transaction data—turning the exchange's own infrastructure into the weapon. The pattern mirrors the …
The Bitget breach shows DPRK actors have moved beyond supply-chain attacks to directly compromising exchange backend wallet infrastructure. The spoofed-transaction technique signals a maturity in targeting signing workflows …
Shield53 analysis: Bitget's $351.6M loss to suspected North Korean actors follows a now-familiar backend-spoofing playbook. The pattern demands a fundamental rethink of exchange wallet authorization architectures.
North Korean actors bypassed Bitget's wallet authorization by spoofing transaction data from a compromised backend system. The attack pattern echoes Bybit and exposes a systemic weakness in how …
Russia's blending of cyber sabotage, disinformation, and kinetic attacks against Ukraine-supporting nations marks a paradigm shift. Defenders must abandon siloed thinking and prepare for converged cyber-physical operations.
A Chinese-speaking threat actor linked to Red Heron is chaining WordPress wp2shell flaws and a Zyxel switch vulnerability to steal government PII and network credentials. Defenders must patch …
A joint multinational advisory confirms North Korea's WaterPlum group infected 30,000+ devices through fake job interviews, stealing $10.7M from crypto developers. The campaign exploits a trust gap that …
Two small Colorado water utilities were compromised by foreign actors who altered OT settings and disabled alarms. The incidents underscore how under-resourced utilities remain prime targets for nation-state …
North Korea's Contagious Interview campaign has compromised 30,000 devices and stolen $10.71M in cryptocurrency, blending fake recruitment with legitimate IT work. The convergence of WaterPlum and Wagemole operations …
North Korea's Jade Sleet continues exploiting trusted IT services relationships to reach crypto and fintech targets. The India-based provider compromise reveals a supply chain attack pattern that defenders …
North Korea's WaterPlum operation has evolved from a niche developer-targeting campaign into a global infrastructure for parallel crypto theft and enterprise espionage. The convergence with fraudulent IT worker …
APT36's Operation RapidRust demonstrates an accelerating trend: nation-state groups abusing trusted developer platforms like GitHub for resilient command-and-control, rendering traditional egress filtering increasingly obsolete.
China-linked FamousSparrow APT is targeting political and governmental organizations in Latin America, exploiting the region's strategic importance in US-China competition. Defenders in government, NGOs, and critical infrastructure should …
Hunt.io's infrastructure-centric analysis of SilkParasite C2 servers demonstrates how TLS certificate clustering and cloned web pages can unmask a multi-year APT campaign targeting Central Asian governments. Defenders should …
Group-IB's attribution of the Handala Hack persona to Iran's MOIS reveals a sophisticated social engineering pipeline deploying the HEAVYGRAM backdoor via Trojanized messaging apps. The campaign targets dissidents …
ESET's discovery of the SparroWocky backdoor reveals FamousSparrow has evolved from using open-source tools alongside custom malware to embedding them directly — a significant development trend among China-aligned …
The China-linked FamousSparrow group has deployed a sophisticated modular backdoor targeting Latin American governments, leveraging advanced in-memory evasion and DLL side-loading. Shield53 analyzes the operational significance and what …
Iran's Chosen Brick malware demonstrates how digital surveillance enables real-world harm. Shield53 analyzes why this joint advisory elevates the stakes for defenders protecting at-risk communities, and what to …
Iranian state-linked actors are weaponing social engineering and legitimate cloud infrastructure to surveil dissidents abroad. The CHOSEN BRICK campaign reveals a shift from network intrusion to individual targeting …
Kaspersky's disclosure of NightEagle, Hacking Cat, and Toy Ghouls targeting Russian enterprises reveals a pattern where years-old CVEs and commodity open-source tools remain devastatingly effective when chained with …
A previously undocumented Linux toolkit targeting load balancers signals a doctrinal shift for North Korean operators — moving beyond Windows-centric espionage to infrastructure-level persistence. Defenders in media, manufacturing, …
A joint FBI/NCSC/AIVD advisory exposes Iranian MOIS malware (HEAVYGRAM/CHOSEN BRICK) using Telegram as C2 to surveil dissidents and journalists. The real story is the pivot to personal devices …
Two China-linked APT groups independently weaponized a Chromium patch gap, turning a fixed-upstream bug into a zero-day against Google Chrome users. The three-CVE exploit chain reveals a growing …
A China-linked threat actor combined three patched zero-days across Chrome and Windows to deliver the GRIMWEDGE backdoor against NGOs. The campaign demonstrates a sophisticated sandbox-escape architecture that defenders …
Sandworm's return to botnet-building via Cisco vulnerability chains shows the Russian GRU unit is rebuilding disrupted infrastructure with smarter techniques. Defenders must prioritize edge device hardening and network …
The 3BB intrusion demonstrates how attackers weaponize trusted remote management tools to maintain persistent root access inside ISP networks, targeting subscriber credential databases with alarming precision.
A China-linked threat actor automated the entire exploitation chain for CVE-2026-60004 within days of disclosure, using a custom C++ implant and LD_PRELOAD rootkit to maintain deep persistence across …
Anthropic's disruption of GTG-20006 reveals Russian APT operators using LLMs to autonomously rebuild detected malware — a workflow that compresses what took days into minutes and fundamentally changes …
UNC3569's exploitation of Sogou Input Method's custom protocol handler exposes a broader problem: ubiquitous trusted software with embedded browsers and disabled sandboxes creates massive attack surfaces that patches …
Proofpoint and Volexity reveal BlueMoon, a modular exploit kit chaining Chrome V8 and Windows ALPC zero-days, deployed by multiple Chinese-aligned APTs since late August 2026. The kit's shared …
The BlueMoon exploit kit chaining CVE-2026-85046 and CVE-2026-85880 spread to four espionage groups within two weeks, exposing a dangerous patch-gap window. Defenders face a compressed timeline between upstream …
Proofpoint's disclosure of the BlueMoon exploit kit — shared by at least four espionage clusters within days — reveals how patch-gap zero-days in Chromium and Windows ALPC are …
Rapid7's discovery of a DPRK-linked backdoor compiled directly into HAProxy source code marks a dangerous shift toward deep infrastructure implantation. Shield53 analyzes why edge-device compromise changes the defender's …
Rapid7's discovery of a trojanized HAProxy implant attributed to North Korean actors exposes a blind spot most organizations never monitor: the infrastructure layer itself. Defenders must rethink integrity …
Hunt.io's discovery of the SecFlow framework shows threat actors have moved beyond AI-generated phishing to full orchestration of intrusion chains using commercial LLMs. This is not theoretical — …
Citizen Lab's confirmation of Pegasus and NoviSpy deployments against Serbian protesters reveals a systemic surveillance problem where commercial spyware continues to enable state-level repression of civil society — …
Citizen Lab confirms Pegasus zero-click exploitation of a Serbian student activist's iPhone months after Apple patched the vector. The case exposes a layered surveillance apparatus blending mercenary spyware, …
The leaked Bauman University documents reveal a systematic, institutionalized approach to developing GRU cyber operators — not ad hoc recruitment but a decade-long academic pipeline. Defenders should treat …
Iran's Mirage Kitten is weaponizing the hiring process itself—trojanizing coding challenges and explicitly banning AI assistants to prevent automated detection of NodeRabbit and PollCat malware. This campaign signals …
Nimbus Manticore's new NodeRabbit and PollCat malware families extend Iranian espionage operations to macOS and Linux via fake coding challenges. The shift to cross-platform JavaScript payloads dramatically widens …
Huntress exposes five DPRK-linked remote workers hired by Western firms in 2026. The threat doesn't enter through a CVE — it enters through HR. Here's what defenders must …
North Korea's fraudulent worker scheme has moved beyond IT roles into healthcare and sales, exploiting remote hiring norms. Shield53 analyzes the detection gaps and what defenders must change …
Sygnia's findings on Fire Ant (UNC3886) show Chinese APTs weaponizing Cisco IOS XR routers as persistent espionage platforms. Defenders must treat network infrastructure as high-value endpoints, not dumb …
China-linked Fire Ant's pivot from endpoints to Cisco IOS XR routers demonstrates why network infrastructure must be treated as untrusted territory. When the device lies about its own …
China-nexus espionage group Fire Ant has expanded from VMware hypervisors to Cisco IOS XR routers, using purpose-built malware to harvest credentials and suppress logging. Defenders must treat network …
The DoJ's quiet correction shifts U.S. agencies from 'victims' to 'targets' of China-linked QTFY—underscoring how infrastructure providers enable espionage without always achieving compromise. The distinction carries real weight …
A suspected Chinese-speaking APT operator used known ownCloud and WordPress vulnerabilities to steal ~9 GB from a Philippine nuclear research body and naval supplier. The operational security failure—leaving …
BlueDelta's use of webhook.site and Microsoft Edge for C2 traffic represents a growing trend of GRU operators hiding espionage activity inside legitimate developer tools and browser processes. Defenders …
APT28's new HOOKEDGE backdoor shows how batch scripting and legitimate webhook services continue to evade enterprise detection. European diplomatic organizations face elevated risk from this evolving HEADLACE successor.
Dark Caracal's GoCaracal malware with blockchain-based C2 fallback represents a significant evolution in APT operational resilience. Defenders must now account for decentralized infrastructure that traditional takedown strategies cannot …
Russian threat actors are shifting phishing campaigns from email to Signal and WhatsApp, targeting EU officials. This reflects a broader adversarial trend toward exploiting trusted messaging platforms where …
Dark Caracal's new Go-based modular framework signals a maturation in their tradecraft—complicating detection and extending dwell time. Defenders in government, defense, and NGO sectors should prioritize behavioral hunting …
North Korean IT worker schemes have matured beyond simple identity fraud into persistent insider access operations. Shield53 breaks down the behavioral indicators that matter most and how to …
The seizure of QScan and QTRouter reveals how China-linked actors are industrializing intrusion infrastructure through compromised IoT botnets offered as a service to state clients. Defenders must rethink …
The FBI's takedown of QTFY's QScan and QTRouter platforms reveals a sophisticated Chinese state-sponsored operation using compromised IoT devices as obfuscation infrastructure for espionage against U.S. critical infrastructure …
Group-IB's disclosure of new TWOSTROKE-variant backdoors and SSH tunneling tools tied to IRGC-linked Nimbus Manticore reveals an Iranian APT group aggressively scaling infrastructure across Europe and the Middle …
The FBI's seizure of QTFY's QScan and QTRouter infrastructure reveals a professionalized 'quartermaster' model for Chinese espionage operations. Shield53 analyzes what this means for defenders and why proxy-hunting …
The U.S. Treasury's sanctioning of Iran-linked hackers exposes a dangerous hybrid threat model where state espionage and personal-profit cybercrime intersect. Critical infrastructure defenders should treat this as an …
A China-nexus APT is leveraging QUIC protocol C2 traffic and LOLBin abuse to target Myanmar government entities. The campaign's use of Cloudflare Workers for infrastructure pivoting and VHD-based …
The UK power plant outage and concurrent US water system breaches signal a shift from espionage to operational disruption. Iran-linked actors are demonstrating they can hold Western critical …
Google GTIG's disclosure of three Russia-linked clusters—UNC6293, UNC7005, and UNC5976—reveals a coordinated abuse of legitimate authentication flows to bypass MFA. Defenders must rethink what 'authenticated' actually means when …
Three suspected Russian threat clusters are abusing legitimate OAuth authentication flows to hijack accounts across Google and WhatsApp. Defenders must rethink identity monitoring as adversaries exploit trusted infrastructure …
A joint federal advisory warns that AI-generated exploitation scripts are actively targeting Siemens S7 PLCs across U.S. critical infrastructure. The barrier to ICS exploitation has collapsed — defenders …
Transparent Tribe's pivot toward Taliban-run Afghan organizations reveals a calculated exploitation of defensive maturity gaps. While Indian government agencies repel these attacks, less-prepared targets remain vulnerable to the …
The expanded indictment of 17 Iranians linked to the Mabna Institute reveals a decade-long operation that monetized stolen academic credentials at industrial scale. The blending of IRGC-directed espionage …
The SilkParasite spear-phishing operation, linked to FamousSparrow, reveals a strategic widening of Chinese-nexus espionage into Central Asia. Defenders in government, energy, and logistics sectors should treat multi-RAT delivery …
The DOJ's expanded charges against 17 Iranians tied to the Mabna Institute underscore how IRGC-affiliated hacking-for-hire operations weaponize academic credentials at scale—and why the eight-year gap between indictments …
A China-nexus espionage cluster deploying five novel RAT families against Central Asian governments reveals how AI is quietly professionalizing threat development rather than generating malware outright. The PlugX-to-BLOODALCHEMY …
Shield53 analysis: The first reported near-autonomous AI-driven nation-state attack signals a shift from AI-assisted to AI-directed operations. Defenders must prepare for faster, more adaptive adversary tradecraft.
The Cavern C2 framework, attributed to Iran's MOIS-linked actors, now abuses Google Apps Script relays and Microsoft 365 calendar dead-drops via Graph API, making traffic nearly indistinguishable from …
North Korea's Kimsuky APT is now embedding AI into attack workflows, from AI-generated lures to local LLM abuse. This shift demands a reassessment of traditional phishing detection and …
Mustang Panda has weaponized CoolClient with a signed kernel rootkit, dramatically raising the detection bar. Shield53 breaks down the tactical shift and what defenders must do now.
A newly documented backdoor campaign exploiting Google Sheets as C2 infrastructure signals a dangerous evolution in APT36's tradecraft. Defenders must rethink trust in legitimate cloud services.
Apple has begun sending a new wave of Threat Notifications to iPhone users targeted by mercenary spyware. Shield53 breaks down who is at risk, what these alerts signify, …
The Jewelbug group is running government webmail intrusions alongside cryptocurrency fraud schemes — a rare hybrid of espionage and financial crime that blurs traditional threat actor classifications and …
The Jewelbug APT blurs the line between state-directed espionage and financially motivated cybercrime. Shield53 examines why dual-purpose threat actors are increasingly dangerous and what defenders must do now.
North Korea's Lazarus Group has intensified Operation Dream Job, deploying a Windows zero-day against defense and aerospace professionals via fake Lockheed Martin job lures. Shield53 breaks down the …
A suspected Chinese APT deployed eight coordinated AI agents in what may be the first fully autonomous cyberattack on a government target. This marks a dangerous inflection point …
North Korea's Lazarus Group exploited a Windows zero-day to achieve SYSTEM-level access and deploy a novel backdoor against defense and aerospace targets. Shield53 breaks down what defenders must …
Russia's Sandworm APT is weaponizing trust in legitimate tools like WireGuard VPN to compromise IT administrators through fake job lures. This campaign signals a dangerous evolution in supply-chain-adjacent …
Sandworm's UAC-0145 subgroup is running fake job interview campaigns against Ukrainian IT professionals, delivering a malicious VPN capable of remote command execution. Here's what defenders need to know.
Iranian-linked threat actors have now struck water utilities across at least 12 U.S. states, including New Jersey and Alabama. Shield53 breaks down the operational pattern, systemic vulnerabilities in …
Security researchers ran a fake crypto startup to catch suspected DPRK IT workers — and the onboarding paper trail they left behind is a masterclass in what HR …
A cyberattack on a Polish combined heat and power plant forced turbine shutdown via a private cellular network, exposing a critical blind spot in OT/ICS security. Shield53 breaks …
A growing wave of cyberattacks against water utilities across a dozen U.S. states is exposing a chronic, systemic failure to secure operational technology. Iran-linked actors are suspected, and …
Microsoft's disclosure of Storm-1175's custom StormEncryptor ransomware marks a critical escalation — a China-linked group moving from commodity tools to bespoke malware, raising the operational stakes for enterprise …
North Korea's Kimsuky APT is now running AI offline on its own servers, removing reliance on monitored public platforms. This capability shift demands defenders rethink detection assumptions built …
Russian APT group Head Mare is exploiting chained TrueConf Server vulnerabilities to replace legitimate client installers with PhantomCore malware, targeting critical Russian industries. Defenders must patch immediately and …
Beijing's CAC probe into Palo Alto Networks signals escalating tech nationalism that every multinational security vendor should treat as a strategic warning. Shield53 breaks down the implications.
Factory-shipped backdoors in 20+ Zbtlink router models open unauthenticated root shells and beacon to Chinese infrastructure. Shield53 breaks down the risk and what defenders must do now.
Microsoft has attributed a sophisticated hotel Wi-Fi credential harvesting campaign to Midnight Blizzard (APT29). Shield53 breaks down the tradecraft, who's truly at risk, and what defenders must do …
Unit 42 observed a Chinese-speaking threat actor leveraging DeepSeek to autonomously scan, select exploits, and execute attacks — marking a dangerous evolution toward fully automated offensive AI operations.
A Chinese threat actor has deployed a weaponized DeepSeek AI agent to autonomously compromise networks at scale. This marks a significant escalation in AI-assisted offensive operations that defenders …
A Chinese threat actor is deploying GHOSTBLADE malware against iOS users via the leaked DarkSword exploit kit, using 100+ fake AWS phishing pages. Here's what defenders need to …
Microsoft has exposed CaptiveCrunch, a sophisticated SVR-linked operation hijacking hotel captive portals to steal Microsoft 365 tokens from high-value travelers. Here's what defenders need to know.
Microsoft has linked hotel Wi-Fi hijacking campaign CaptiveCrunch to Midnight Blizzard, deploying the CornFlake RAT via fake browser updates. This is precision espionage targeting travelers at their most …
South Korean intelligence and law enforcement agencies jointly warn of coordinated state-backed watering hole attacks targeting citizens and businesses. Shield53 breaks down the tactical implications and what defenders …
A suspected Chinese-speaking threat actor has been targeting Central Asian governments with novel malware families OctLurk and SilkLurk since early 2025. Shield53 breaks down the tactical significance and …
Unit 42 researchers have documented a Chinese-speaking threat actor leveraging DeepSeek through an open-source AI agent framework to autonomously identify targets and select exploits — a pivotal moment …
SilverFox's latest ValleyRAT campaign against a Japanese manufacturer reveals alarming technical evolution—new DLL sideloading hosts, kernel-level drivers, and layered persistence that demands immediate attention from industrial sector defenders.
A suspected Iran-backed threat campaign against Minnesota community water systems highlights the acute and growing cyber risk facing small utilities with limited security resources. Here's what defenders must …
North Korea's Contagious Interview campaign has evolved to weaponize macOS malvertising with convincing fake update screens, putting crypto professionals and developers at heightened risk of asset theft.
Amazon has linked coordinated npm supply chain attacks — targeting high-traffic packages like Debug and Chalk — to North Korean state actors. This signals a maturing DPRK strategy …
State-sponsored attackers are silently compromising South Korean visitors through trusted domestic websites, exploiting AnySign4PC to deploy advanced backdoors with zero user interaction required.
Analysis reveals eSIM Plus and Nicegram share Belarus-linked code while routing data through Russian infrastructure — despite branding as Lithuanian products. This supply chain deception poses serious risks …
A Russian threat group previously tied to Zimbra exploitation is now targeting Microsoft OWA to maintain persistent email access across credential rotations — a tactic that blindsides organizations …
Amazon has formally attributed the 2025 debug/chalk npm hijack to North Korea's Sapphire Sleet. With 2B+ weekly downloads affected, this reframes a crypto theft incident as a state-sponsored …
Russian APT Laundry Bear (Void Blizzard) is exploiting an Exchange OWA zero-day to plant a persistent backdoor dubbed OWAReaper. Here's what defenders need to know immediately.
Russia's FSB charges against Telegram's founder represent a calculated escalation in state efforts to compel encrypted messaging platforms into compliance. The implications stretch far beyond one founder — …
Iranian APT Nimbus Manticore is deploying a novel Windows backdoor and WebSocket tunnelers to silently relay traffic through victim systems. Shield53 breaks down the threat and what defenders …
A cyberattack on Thailand's Ministry of Finance used an autonomous AI agent called Hermes in unrestricted 'YOLO mode' to conduct espionage — a landmark case signaling that agentic …
A newly identified East Asia-linked threat actor is deploying three novel malware families — TELESHIM, MIXEDKEY, and BINDCLOAK — against Middle Eastern government targets, abusing Telegram's infrastructure for …
State-linked actors are intensifying attacks on water and energy control systems, signaling a dangerous escalation in critical infrastructure targeting. Defenders in OT/ICS environments must act now.
Federal agencies confirm Iran-linked actors have breached internet-exposed water and energy control systems and are making configuration changes. Shield53 breaks down the operational risk and what critical infrastructure …
BlueNoroff's ClickFix-style phishing infrastructure reveals a dangerous evolution: profiling crypto wallet types before delivering tailored malware. Here's what defenders need to know.
Hunt.io's discovery of an AI-driven cyber-espionage campaign against Thailand's Finance Ministry reveals how threat actors are now deploying autonomous AI agents alongside traditional implants — raising the stakes …
Russia-aligned APT UAC-0099 is now concealing malware inside counterfeit Notepad++ plugins, employing argument-dependent execution to frustrate sandbox analysis. Ukrainian organizations remain prime targets in this escalating phishing campaign.
Russian APT group Laundry Bear is actively exploiting a known Zimbra vulnerability to harvest email credentials. Organizations running unpatched Zimbra servers face serious espionage risk, with a multi-agency …
Russian APT 'Laundry Bear' is exploiting a Zimbra zero-day requiring no full user interaction — just opening an email triggers compromise. Here's what defenders must do now.
A Russian state-sponsored espionage group silently exploited an unpatched Zimbra webmail flaw to exfiltrate 90 days of email, full contact directories, browser passwords, and 2FA recovery codes — …
Russian APT Laundry Bear (Void Blizzard) is chaining phishing with a patched Zimbra zero-click flaw to silently exfiltrate email. Organizations still running unpatched Zimbra instances face serious espionage …
A misconfigured Alibaba Cloud server exposed the China-nexus JadeProx operation and its novel TriBack Loader. Government, healthcare, and education sectors across Asia and Latin America are in the …
CISA warns that Russian APT group LAUNDRY BEAR has been systematically targeting Zimbra Collaboration Suite users across Western governments since July 2025. Here's what defenders need to know.
A ten-month undetected breach of South Korea's National Diplomatic Academy exposes systemic gaps in monitoring sensitive government networks — and signals serious counterintelligence risk for diplomats worldwide.
Dutch intelligence confirms Russia is systematically hijacking IP cameras near military facilities to surveil NATO weapons shipments to Ukraine — a low-tech, high-impact espionage vector defenders are dangerously …
Russian intelligence is weaponizing civilian IP cameras across NATO states to surveil military logistics. This campaign exposes a critical blind spot: commercial surveillance infrastructure has become a frontline …
A threat actor is weaponizing ViPNet's update mechanism to infiltrate Russian government networks, highlighting the enduring danger of trusted software channels as covert intrusion pathways.
Russia's Sandworm subgroup UAC-0145 is exploiting ClickFix CAPTCHA lures to manipulate Ukrainian targets into self-installing malware. This tactic shift reveals how GRU-linked actors are blending psychological manipulation with …
The rediscovery of China's Daxin rootkit on an active manufacturing network reveals alarming truths about APT persistence, detection gaps, and the long-tail threat of kernel-level implants that organizations …
North Korean threat actors are hiding malware inside SVG image files used in fake coding interviews, with zero antivirus detection. Developers and tech recruiters are prime targets in …
The attribution of the April 2026 DigiCert breach to CylindricalCanine, a GoldenEyeDog subgroup, reveals a calculated shift toward certificate infrastructure targeting with severe supply chain implications.
North Korea's Contagious Interview campaign now embeds multi-stage malware inside SVG image files, targeting developers via fake coding tests. The sophistication signals a dangerous evolution in DPRK social …
As NATO and allied forces race to deploy autonomous military systems at commercial speed, the information infrastructure underpinning those systems may not be keeping pace. Shield53 examines what …
A newly discovered malware framework called GoSerpent is conducting long-term espionage against Southeast Asian governments and diplomats. Shield53 examines the strategic implications and what defenders must do now.
Chinese threat actors are now integrating frontier AI coding tools into active espionage campaigns, automating intrusion tasks against government and financial targets. This marks a dangerous escalation in …
Western intelligence agencies are warning that Russian state-sponsored APT groups are systematically targeting misconfigured and unpatched network devices to penetrate critical infrastructure. Here's what defenders must do now.
Joint UK-EU sanctions against Russian cyber actors mark a geopolitical milestone, but without stronger baseline defenses, symbolic measures alone won't protect critical infrastructure from ongoing campaigns.
The EU's latest sanctions against FSB-linked operatives expose a decade-and-a-half of patient, persistent Russian cyber operations. Shield53 breaks down what this means for critical infrastructure defenders and Western …
CISA, NSA, and FBI warn that Russian FSB Center 16 actors are actively exploiting misconfigured routers across critical infrastructure. Shield53 breaks down what defenders must prioritize immediately.
The EU and UK's coordinated sanctions package against Russian GRU-linked hackers marks a significant shift toward unified Western cyber deterrence. Shield53 examines what this means for threat defenders …
A rare multi-nation advisory signals escalating Russian cyber aggression against critical infrastructure. Shield53 breaks down what defenders must prioritize now to harden network perimeters against state-sponsored intrusion.
Suspected Chinese and Indian threat actors both targeted Pakistani law enforcement infrastructure over a two-year campaign. Shield53 examines what this multi-group convergence signals for regional cyber tensions.
Silver Fox's new Rust-based MODBEACON RAT uses gRPC streaming for C2 communications, blending malicious traffic with legitimate cloud patterns. This architectural choice raises the detection bar significantly for …
Iranian threat actors are broadening their targeting beyond critical infrastructure, putting mid-market and private sector organizations at real risk. Obscurity is not a security strategy.
A China-linked threat cluster is exploiting Roundcube webmail vulnerabilities to compromise university servers in the U.S. and Canada. Academic institutions must act immediately to patch, audit, and harden …
China-linked UAT-7810 is evolving its ORB infrastructure with custom LONGLEASH malware targeting edge devices. Shield53 breaks down why this represents a significant escalation in Beijing-aligned cyber operations.
Chinese threat actor UAT-7810 is deploying novel LONGLEASH malware to compromise unpatched networking devices and grow their Operational Relay Box infrastructure — a tactic that makes attribution harder …
Spanish authorities arrested a suspected collaborator of pro-Russian hacktivist groups CARR, Z-Pentest, and NoName057(16) in an FBI-led operation — a rare criminal prosecution that signals growing Western resolve …
A Spanish arrest of a suspected CARR and Z-Pentest member signals that Western law enforcement is closing the net on pro-Russian hacktivist networks — and raises urgent questions …
A suspected China-aligned threat cluster is exploiting critical Roundcube flaws against U.S. and Canadian university physics and engineering departments — a high-value espionage target with serious national security …
The Armored Likho APT group is weaponizing AI-generated malware and the BusySnake stealer against government and energy sector targets. Here's what defenders need to know about this emerging …
A newly identified C2 framework dubbed Cavern is being wielded by an Iranian state-linked threat cluster against Israeli IT providers and government entities, signaling a sophisticated escalation in …
A suspected China-linked threat cluster is weaponizing India's tax season, deploying DcRAT through convincing Income Tax Department impersonation. Shield53 breaks down the TTPs and what defenders must do …
North Korean actors behind Contagious Interview are flooding npm, Packagist, Go, and Chrome extensions with malicious packages. Shield53 breaks down the supply chain risk and what dev teams …
A former MEP investigating Pegasus was himself infected with it — a chilling demonstration of how surveillance tools undermine the very institutions meant to oversee them. Shield53 breaks …
North Korean threat actors are poisoning the npm ecosystem with packages mimicking legitimate Rollup tooling. Shield53 breaks down the supply chain risk and what development teams must do …
The Armored Likho threat actor blurs the line between cybercrime and espionage, targeting government agencies and power grids while simultaneously running financially motivated campaigns — a hybrid model …
Citizen Lab confirms Pegasus spyware was deployed against a sitting MEP probing surveillance tool abuses — a brazen attack on legislative oversight that signals no investigator is beyond …
The ToddyCat APT group's new Umbrij malware weaponizes OAuth to silently exfiltrate corporate Gmail communications via Google's own API — a stealthy technique that bypasses traditional credential-theft detection …
The confirmed compromise of DHS's Homeland Security Information Network is more than a federal IT incident — it's a strategic intelligence failure with cascading risks for every partner …
A sophisticated China-linked threat group has compromised at least 10 organizations across Southeast Asia, including state-owned entities, deploying a novel backdoor. Shield53 examines the strategic implications and what …
Washington has placed a $10 million bounty on members of two Russian FSB-linked hacking groups targeting officials, journalists, and diplomats through sophisticated messaging app infiltration tactics.
Nation-state actors from Iran, Russia, and China are breaching water utility systems using rudimentary tactics — exposed PLCs, default credentials, and flat networks. Sophisticated malware isn't the threat; …
The U.S. State Department is offering up to $10 million for intelligence on two Russian-linked hacker groups systematically compromising encrypted messaging accounts of government and military officials.
China-aligned threat group Mustang Panda has compromised Indian government networks using Zoho WorkDrive as a covert command channel. Senior administrative machines were among those confirmed breached in a …
Russia's Gamaredon APT group has dramatically escalated its cyber operations against Ukraine in 2025, deploying novel malware strains and abusing legitimate cloud infrastructure to evade detection across dozens …
A joint investigation by Ukrainian and U.S. intelligence agencies has exposed a sustained Russian operation harvesting messenger credentials from government officials, military personnel, and activists across multiple continents.
Russian intelligence conducted a years-long campaign using fraudulent technical support texts to steal messaging credentials from Ukrainian officials, military personnel, and Western targets. Here's what happened and how …
Updated FBI and CISA guidance reveals Russian FSB-linked operators have shifted focus from stealing verification codes to harvesting Signal Backup Recovery Keys, enabling persistent account access and full …
A phishing campaign tied to Russian intelligence has shifted tactics, tricking Signal users into surrendering their Backup Recovery Keys — giving attackers full access to historical messages stored …
FBI and CISA warn that Russian intelligence operatives have upgraded their Signal phishing campaign to steal Backup Recovery Keys — granting persistent, silent access to encrypted message histories.
A sophisticated Chinese-speaking threat actor has been systematically breaching Southeast Asian government and energy networks since 2022, deploying a newly discovered backdoor alongside trusted open-source tools to maintain …
A Chinese-speaking APT group has deployed a sophisticated custom backdoor targeting government agencies and state-owned enterprises across Southeast Asia. Here's what security teams need to know.
Federal agencies are sounding the alarm as Russian state-sponsored actors intensify efforts to compromise commercial messaging applications through sophisticated phishing campaigns. Here's what organizations need to know.
Russian authorities used Cellebrite's phone-cracking technology on a jailed opposition activist months after the company claimed to have cut off sales. The case exposes how export controls on …
A DPRK-linked Rust implant for macOS doesn't just steal data — it tries to manipulate AI-assisted malware analysts into abandoning their investigation. Here's what security teams need to …
Russian state-sponsored group Turla has deployed a newly identified .NET backdoor called STOCKSTAY against Ukrainian government and military targets. The malware represents a sophisticated evolution in Russia's ongoing …
The Kremlin-backed threat group Gamaredon has significantly upgraded its malware delivery and infrastructure concealment capabilities. Here's what defenders need to know.
North Korean state actor Sapphire Sleet has been linked to a sophisticated supply chain attack on the Mastra AI ecosystem, compromising over 140 npm packages to deploy credential-stealing …
China-linked FishMonger has expanded its SprySOCKS backdoor beyond Linux, deploying two Windows variants with kernel-level stealth and signs of UEFI bootkit use against governments across four countries.
The China-nexus threat group FishMonger has unleashed a previously undocumented Windows variant of the SprySOCKS backdoor, leveraging kernel driver abuse to evade detection across government networks in four …
A backdoor previously thought to target only Linux systems has now been confirmed on Windows, bringing driver-based stealth capabilities to a broader attack surface. Here's what security teams …
APT37, the North Korean state-sponsored group known as ScarCruft, is deploying a sophisticated remote access trojan called NarwhalRAT through convincing Microsoft security alert impersonations. Here's what defenders need …
A China-linked threat actor embedded itself inside North American medical and military research organizations for over two years, harvesting credentials and silently forwarding sensitive emails. Here's how they …
A sophisticated China-linked threat actor infiltrated American research institutions undetected for more than 12 months, stealing credentials and exfiltrating sensitive data. Google's security teams uncovered and dismantled the …
Sophisticated threat actors spent over a year infiltrating North American medical research systems, deploying custom malware to steal sensitive healthcare data through innovative email-based exfiltration techniques.
Advanced persistent threat actors are compromising authentication systems to maintain invisible access for years. Learn how they bypass traditional security measures and what you can do to protect …
The sophisticated JDY botnet has grown to over 1,500 compromised devices, conducting rapid vulnerability reconnaissance against U.S. military networks and critical infrastructure for Chinese APT groups.
WhatsApp parent company disrupts new spear-phishing operations linked to sanctioned Israeli spyware vendor, highlighting persistent threats to high-value targets despite legal victories.
UNC5221, a sophisticated Chinese espionage group, has been using an expanded malware toolkit including Brickstorm, Plenet, and AgentPSD to maintain 18+ month network persistence across M365 environments.
Treasury's OFAC blacklists Nobitex and three other Iranian cryptocurrency platforms for processing over half of Iran's digital asset flows and enabling IRGC-linked ransomware operations.
Security researchers have uncovered a complex espionage operation utilizing AI tools to create convincing attack vectors against Ukrainian targets across multiple sectors.
Financial investigators seized 800 servers and arrested two individuals running hosting services that facilitated sanctioned Russian cyberattacks and disinformation campaigns across Europe.
State-sponsored Chinese threat actors have unleashed sophisticated Linux and Windows implants targeting telecommunications infrastructure across Asia Pacific and the Middle East since 2022.
State-sponsored hackers have evolved their decade-old Kazuar malware into a modular botnet architecture that uses peer-to-peer communications and autonomous leadership selection to evade detection while conducting long-term intelligence …
MuddyWater's sophisticated campaign demonstrates evolved tactics targeting critical infrastructure and intellectual property across multiple continents, signaling a new phase of state-sponsored cyber espionage.
The encrypted messaging platform implements new security warnings and user confirmations following Russian intelligence operations targeting high-profile accounts through fraudulent support messages.
U.S. authorities sentenced two Americans to prison for operating laptop farms that enabled North Korean operatives to infiltrate dozens of companies, highlighting the growing threat of state-sponsored employment …
MuddyWater operatives are using Chaos ransomware as cover for intelligence gathering missions, highlighting how nation-state actors increasingly adopt criminal tactics to evade detection.
A contract hacker allegedly working for China's Ministry of State Security faces federal charges for targeting COVID-19 research and exploiting Exchange Server vulnerabilities in a sophisticated intelligence operation.
Intelligence agencies warn that Chinese threat actors have pivoted to massive botnets of compromised routers and smart devices, rendering IP-based defenses obsolete.
A sophisticated Chinese-linked threat actor demonstrates how legitimate business tools become invisible attack infrastructure, compromising government targets across multiple nations.
State-sponsored Harvester group expands Linux capabilities with sophisticated backdoor that leverages legitimate Microsoft infrastructure for covert command and control operations.
Security researchers have uncovered a multi-stage destructive attack framework that systematically destroys compromised systems through disk overwriting and recovery elimination.
The Lazarus Group allegedly orchestrated a sophisticated attack on KelpDAO's verification layer, exploiting compromised RPC nodes and DDoS tactics to steal nearly 117,000 rsETH tokens worth $290 million.
A sophisticated identity theft operation enabled DPRK workers to secure employment at major corporations, generating millions while compromising national security through remote access schemes.
APT37 hackers exploit Facebook's social networking features to build victim trust before delivering remote access trojans. The campaign demonstrates how social engineering tactics continue evolving on mainstream platforms.
The Handala group claims to have compromised three critical UAE government systems, destroying petabytes of data in what appears to be escalating cyber warfare targeting regional allies.
Iranian state actors target thousands of exposed devices while new GPU-based privilege escalation attacks emerge. Plus: Zero-day exploits accelerate and ransomware disrupts healthcare systems across Europe.
Security researchers have discovered thousands of internet-exposed industrial control systems vulnerable to Iranian state-sponsored cyberattacks, with three-quarters located in the United States.
Federal agencies warn that Iranian state-sponsored hackers are exploiting nearly 4,000 internet-exposed industrial control systems across US critical infrastructure, marking a dangerous escalation in cyber warfare tactics.
Iranian state-backed hackers are exploiting nearly 4,000 internet-exposed Rockwell Automation PLCs across US critical infrastructure, marking a dangerous escalation in operational technology warfare.
Iranian state-sponsored groups are systematically targeting thousands of exposed industrial control systems across U.S. critical infrastructure, revealing dangerous security gaps in operational technology networks.
A sophisticated Lua-based malware framework targets Taiwan's NGOs and universities through password-protected phishing emails, employing advanced evasion techniques and modular deployment strategies.
State-backed Russian hackers compromised over 18,000 routers to intercept Microsoft authentication tokens without deploying malware. The campaign exploited outdated consumer routers to bypass multi-factor authentication.
GRU-linked threat actors compromised 18,000 routers to steal OAuth tokens from Microsoft Office users, demonstrating how legacy infrastructure creates national security risks.
State-sponsored hackers compromised 18,000 routers to perform DNS hijacking attacks, bypassing multi-factor authentication to steal Microsoft Office credentials from government agencies and enterprises.
Advanced persistent threat actors with ties to Iran are systematically targeting internet-facing programmable logic controllers across critical infrastructure sectors, causing operational disruptions and financial losses through sophisticated OT …
A proof-of-concept monitoring system built in a single afternoon successfully detected one of the largest npm supply chain compromises, attributed to North Korean state actors targeting the popular …
A recently disclosed zero-day vulnerability (ZDI-CAN-25373) in Microsoft Windows has been actively exploited by multiple state-sponsored threat actors since 2017.