Latest Cyber-espionage news

France says Russian state hackers breached numerous critical networks

The Russian APT28 hacking group (aka 'Strontium' or 'Fancy Bear') has been targeting government entities, businesses, universities, research institutes, and think tanks in France since the second half of 2021.
- Bill Toulas
- October 26, 2023
- 12:40 PM
- 0
European govt email servers hacked using Roundcube zero-day

The Winter Vivern Russian hacking group has been exploiting a Roundcube Webmail zero-day since at least October 11 to attack European government entities and think tanks.
- Sergiu Gatlan
- October 25, 2023
- 07:00 AM
- 0
Iranian hackers lurked in Middle Eastern govt network for 8 months

The Iranian hacking group tracked as OilRig (APT34) breached at least twelve computers belonging to a Middle Eastern government network and maintained access for eight months between February and September 2023.
- Bill Toulas
- October 19, 2023
- 12:40 PM
- 0
Women Political Leaders Summit targeted in RomCom malware phishing

A new, lightweight variant of the RomCom backdoor was deployed against participants of the Women Political Leaders (WPL) Summit in Brussels, a summit focusing on gender equality and women in politics.
- Bill Toulas
- October 15, 2023
- 10:16 AM
- 0
ToddyCat hackers use 'disposable' malware to target Asian telecoms

A newly discovered campaign dubbed "Stayin' Alive" has been targeting government organizations and telecommunication service providers across Asia since 2021, using a wide variety of "disposable" malware to evade detection.
- Bill Toulas
- October 12, 2023
- 10:09 AM
- 0
China-linked cyberspies backdoor semiconductor firms with Cobalt Strike

Hackers engaging in cyber espionage have targeted Chinese-speaking semiconductor companies with TSMC-themed lures that infect them with Cobalt Strike beacons.
- Bill Toulas
- October 05, 2023
- 02:57 PM
- 0
Lazarus hackers breach aerospace firm with new LightlessCan malware

The North Korean 'Lazarus' hacking group targeted employees of an aerospace company located in Spain with fake job opportunities to hack into the corporate network using a previously unknown 'LightlessCan' backdoor.
- Bill Toulas
- September 29, 2023
- 05:30 AM
- 1
Budworm hackers target telcos and govt orgs with custom malware

A Chinese cyber-espionage hacking group tracked as Budworm has been observed targeting a telecommunication firm in the Middle East and a government entity in Asia using a new variant of its custom 'SysUpdate' backdoor.
- Bill Toulas
- September 28, 2023
- 09:52 AM
- 0
US and Japan warn of Chinese hackers backdooring Cisco routers

A joint cybersecurity advisory by the FBI, NSA, CISA, and the Japanese NISC (cybersecurity) and NPA (police) sheds light on the techniques the Chinese threat actors known as BlackTech use to attack Japanese and U.S. organizations.
- Bill Toulas
- September 27, 2023
- 11:51 AM
- 0
Evasive Gelsemium hackers spotted in attack against Asian govt

A stealthy advanced persistent threat (APT) tracked as Gelsemium was observed in attacks targeting a Southeast Asian government that spanned six months between 2022 and 2023.
- Bill Toulas
- September 23, 2023
- 11:09 AM
- 0
‘Sandman’ hackers backdoor telcos with new LuaDream malware

A previously unknown threat actor dubbed 'Sandman' targets telecommunication service providers in the Middle East, Western Europe, and South Asia, using a modular info-stealing malware named 'LuaDream.'
- Bill Toulas
- September 21, 2023
- 03:50 PM
- 0
New SprySOCKS Linux malware used in cyber espionage attacks

A Chinese espionage-focused hacker tracked as 'Earth Lusca' was observed targeting government agencies in multiple countries, using a new Linux backdoor dubbed 'SprySOCKS.'
- Bill Toulas
- September 18, 2023
- 10:05 AM
- 2
US govt email servers hacked in Barracuda zero-day attacks

Suspected Chinese hackers disproportionately targeted and breached government and government-linked organizations worldwide in recent attacks targeting a Barracuda Email Security Gateway (ESG) zero-day, with a focus on entities across the Americas.
- Sergiu Gatlan
- August 29, 2023
- 08:00 AM
- 2
Microsoft: Stealthy Flax Typhoon hackers use LOLBins to evade detection

Microsoft has identified a new hacking group it now tracks as Flax Typhoon that argets government agencies and education, critical manufacturing, and information technology organizations likely for espionage purposes.
- Bill Toulas
- August 25, 2023
- 11:56 AM
- 0
North Korean hackers 'ScarCruft' breached Russian missile maker

The North Korean state-sponsored hacking group ScarCruft has been linked to a cyberattack on the IT infrastructure and email server for NPO Mashinostroyeniya, a Russian space rocket designer and intercontinental ballistic missile engineering organization.
- Bill Toulas
- August 07, 2023
- 10:57 AM
- 0
Russian state hackers lure Western diplomats with BMW car ads

The Russian state-sponsored hacking group 'APT29' (aka Nobelium, Cloaked Ursa) has been using unconventional lures like car listings to entice diplomats in Ukraine to click on malicious links that deliver malware.
- Bill Toulas
- July 12, 2023
- 03:01 PM
- 1
Hackers target European government entities in SmugX campaign

A phishing campaign that security researchers named SmugX and attributed to a Chinese threat actor has been targeting embassies and foreign affairs ministries in the UK, France, Sweden, Ukraine, Czech, Hungary, and Slovakia, since December 2022.
- Bill Toulas
- July 03, 2023
- 12:44 PM
- 0
CISA orders govt agencies to patch bugs exploited by Russian hackers

On Thursday, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six more security flaws to its known exploited vulnerabilities (KEV) list.
- Sergiu Gatlan
- June 22, 2023
- 03:04 PM
- 0
Chinese APT15 hackers resurface with new Graphican malware

The Chinese state-sponsored hacking group tracked as APT15 has been observed using a novel backdoor named 'Graphican' in a new campaign between late 2022 and early 2023.
- Bill Toulas
- June 21, 2023
- 06:00 AM
- 0
Russian APT28 hackers breach Ukrainian govt email servers

A threat group tracked as APT28 and linked to Russia's General Staff Main Intelligence Directorate (GRU) has breached Roundcube email servers belonging to multiple Ukrainian organizations, including government entities.
- Sergiu Gatlan
- June 20, 2023
- 09:00 AM
- 0