12 threads tagged with “apt”
Symantec analysts uncovered a new campaign linked to the Russian Sandworm APT using living-off-the-land techniques to infiltrate government and enterprise networks. Attackers rely on legitimate Window…
Category: Threat Intelligence / APT / Nation-State
Security researchers identified a reemergence of the Hacking Team’s successor group, Mem3nt0 Mori, associated with advanced spyware and Chrome zero-day exploitation. The campaign links to state-backed…
Category: Threat Intelligence / APT Operations / Espionage Campaigns
The MSMT report, supported by Chainalysis, reveals that DPRK-linked groups have stolen over $2.8B in cryptocurrency between January 2024 and September 2025. The report outlines laundering through Russ…
Category: Threat Intelligence / Nation-State Activity / Financial Cybercrime
Check Point’s weekly bulletin highlights multiple incidents: Toys 'R' Us Canada breach, Askul ransomware disrupting logistics, Verisure data breach via billing partner, LastPass-themed phishing tied t…
Category: Threat Alerts / Threat Intelligence / Threat Intelligence
Check Point researchers have confirmed the resurgence of the LockBit ransomware group with the release of LockBit 5.0, targeting organizations across multiple continents. The new variant introduces en…
Category: Threats / Ransomware / LockBit
The Iranian APT group MuddyWater (Seedworm) has been linked to a global espionage campaign targeting over 100 organizations across the Middle East, North Africa, and beyond. Leveraging compromised ema…
Category: Threat Alerts / Threat Intelligence / Nation-State Campaigns
SentinelLabs uncovered the PhantomCaptcha campaign targeting humanitarian and government organizations involved in Ukraine relief efforts. Attackers impersonated the Ukrainian President’s Office using…
Category: Threat Alerts / Threat Intelligence / Phishing & Espionage Campaigns
Google’s TAG reports Coldriver (aka Star Blizzard/Callisto/UNC4057) rapidly replaced its exposed LostKeys malware with a new toolchain: NOROBOT initial payload, YESROBOT backdoor, and MAYBEROBOT succe…
Category: Threat Alerts / Threat Intelligence / Threat Intelligence
Reporting indicates the Russia‑linked COLDRIVER group shifted from stealer malware to using NOROBOT loaders and NOROBOT→MAYBEROBOT backdoors, simplifying the chain to evade detection while maintaining…
Category: Threat Alerts / Threat Intelligence / Threat Intelligence
Google Threat Intelligence describes evolving COLDRIVER tradecraft: NOROBOT loaders set logon scripts that fetch a PowerShell‑based MAYBEROBOT backdoor (aka SIMPLEFIX), offering flexible command execu…
Category: Threat Alerts / Threat Intelligence / Threat Intelligence
The Chinese APT group 'Jewelbug' quietly infiltrated a Russian IT firm’s internal network, maintaining access for months to exfiltrate sensitive infrastructure data. The campaign reflects increasing g…
Category: Threat Intelligence / Espionage / Nation-State
ReliaQuest attributes a year-long stealthy intrusion to Flax Typhoon (aka Ethereal Panda/RedJuliett), modifying an ArcGIS Java SOE into a gated web shell and embedding it into backups for persistence.…
Category: Threat Alerts / Threat Intelligence / APT & Espionage