Tag: apt
121 articles
Chinese hackers exploit BeyondTrust zero-day in espionage push
Chinese hackers have been exploiting a critical zero-day vulnerability in BeyondTrust Remote Support, first detected on August 29, in a sophisticated espionage campaign attributed to the threat group Armory Castle. A patch was released on October 8 to fix the defect, tracked as CVE-2026-102764.
Taiwan Research Targets Hit with AI-Powered Google Phishing
Cisco Talos uncovered a sneaky phishing scam that targeted Taiwan research organizations, using fake websites that masqueraded as legitimate institutions to steal Google account credentials. The clever attackers even impersonated well-known universities and policy groups to gain their victims' trust.
Fortinet Flaw Exploited to Deploy PEERSTITCH Malware
Hackers exploited a critical Fortinet flaw to breach a telecom provider's system, harvesting sensitive data from over 500 firewalls to deploy a sneaky, hard-to-detect malware implant. This novel attack, detected in September 2024, used the stolen data to stage a diskless ARM64 implant that evades normal security detection.
Citizen Lab Exposes Candiru Spyware Infections Through Targeted Online Ads
Meet the sneaky spyware that can infect your device with just a single online ad - no clicks required. Citizen Lab researchers uncovered a cunning ad-delivery chain used by Discover-Tech to spread zero-click spyware, infecting targets with alarming precision.
Forescout Researchers Expose ROMULUS Malware Server Leveraging ClickFix
Forescout researchers have uncovered a cunning malware server, dubbed ROMULUS, that's linked to a notorious campaign called ClickFix, and what's alarming is that it can deliver multiple payloads. This discovery was made by Vedere Labs, part of Forescout Research, who identified six servers running the ROMULUS platform.
Ivanti Zero-Day Exploited Before Patch Release
Ivanti's internal discovery of a zero-day vulnerability in June didn't stop attackers from exploiting it in the wild by October 1, highlighting a disturbing gap in patch protection. Researchers uncovered a chain of three zero-day flaws being used to breach Ivanti Connect Secure authentication and execute remote code.
Chinese Hackers Exploit AI-Powered Tool to Breach Korean Banks
Chinese hackers have breached South Korean financial institutions using an AI-powered tool, with CrowdStrike Intelligence uncovering evidence of exfiltrated data and a sophisticated campaign that went beyond mere reconnaissance. The alarming breach, active from late September to early October, highlights the growing threat of AI-fueled cyberattacks.
FBI Disrupts Flax Typhoon Tools Used in US Critical Infrastructure Intrusions
The FBI and Department of Justice have struck a major blow against a China-linked hacking group, seizing seven domains and blocking access to malicious tools used to infiltrate US and foreign critical infrastructure. This disruption targets Flax Typhoon, a notorious threat actor known for its widespread vulnerability scanning and intrusions.
FBI Disrupts Chinese Hacking Tools, Warns of PRC Spies Targeting Global Networks
The FBI has struck a blow against Chinese hackers, seizing seven web domains linked to a suite of hacking tools, including the notorious FishHub malware, which was used to target global networks, including roughly 20 Taiwanese universities. This malware was designed to facilitate phishing activity, allowing hackers to gain a foothold in vulnerable systems.
China-Linked Hackers Expose Email Portal With Stolen Data
Meet Integrity Technology Group, a China-based company with ties to the government that's been caught red-handed running a web portal that lets others snoop on stolen emails. The US and UK have already slapped sanctions on the company, but the details of its shady operation are only now coming to light.
Iranian State-Backed Actor Targets Iraqi Infrastructure
In a chilling move, Iranian state-backed hackers launched a stealthy campaign, dubbed Blinder Tunnel, that infiltrated Iraqi critical infrastructure by tricking developers into opening a booby-trapped Visual Studio project file. This cunning attack unfolded in three swift steps, allowing the hackers to execute malicious code without triggering a compile or user-run binary.
China-Nexus Espionage Campaign Exploits Outlook, OneDrive
A sneaky espionage campaign, tracked as UAT-11587, has been exploiting Microsoft Outlook and OneDrive to secretly control its targets, with a reach that spans 16 entities across eight Asian countries. The sophisticated attack, first detected in September 2025, has been targeting academic, think-tank, and civil-society organizations, with evidence of continued activity through May 2026.
OpenAI Disrupts AI Model Extraction Campaign Tied to Moonshot AI
OpenAI successfully foiled a large-scale attempt to illicitly extract sensitive information from its AI models, thwarting a sophisticated campaign that involved over 15,000 users and nearly 16,000 attempted requests. Fortunately, no sensitive data was compromised, thanks to robust security measures that prevented encryption breaches, database hacks, or unauthorized access to user conversations.
Star Blizzard Deploys RedFlick Malware via Automated Phishing Attacks
Microsoft warns that Star Blizzard, a Russian state actor, has launched over 13 large-scale phishing campaigns this year, infecting over 100 US and UK organizations with the RedFlick malware. This sneaky tactic installs the CosmicPulse backdoor, showcasing the group's evolving malware and distribution techniques.
Microsoft Tracks Russian Hacker Group Star Blizzard's Global Phishing Expansion
Microsoft has uncovered a significant shift in the tactics of Russian hacker group Star Blizzard, which has begun conducting large-scale phishing campaigns in addition to its previous targeted spear-phishing operations. This new approach, observed in 2026, marks a major expansion of the group's phishing activities, with campaigns now sending tens to hundreds of automated emails.
Star Blizzard Exploits Fake Invites to Deploy Windows Backdoor
Over 100 organizations, primarily in the US and UK, have fallen prey to a sophisticated phishing scam that uses fake event invites to install a sneaky Windows backdoor, with Microsoft tracing the attacks back to a Russian hacking group. The campaign, which has been running in waves since January, appears to be targeting individuals and organizations with ties to Ukraine.
North Korea Targets Bitget in $387.5M Crypto Heist
North Korean hackers pulled off a brazen $387.5 million crypto heist by infiltrating a key backend system of Bitget, a leading crypto exchange, and exploiting it to siphon off digital assets. The attack, bearing all the hallmarks of a sophisticated North Korean operation, left Bitget's cold wallets and customer balances remarkably unscathed.
ClickFix Campaign Targets Ukraine with Psychedelic Stealer Malware
Malicious hackers have launched a sneaky campaign in Ukraine, hijacking local business websites to spread a powerful malware called Psychedelic Stealer, which can swipe sensitive info from unsuspecting victims' computers. They even used a fake Cloudflare verification trick to make the attack look legit.
Chinese Hackers Exploit Chrome-Windows Zero-Days to Deploy CLEANGULP Malware
Chinese hackers masqueraded as reputable media organizations and NGOs, using convincing phishing messages and fake sites to deploy the CLEANGULP malware, with one recent campaign targeting Asian government entities over support for a Hong Kong activist. They sent spoofed emails that appeared to be from the Center for American Progress, complete with links to suspicious domains.
North Korean Hackers Infect 30,000 Devices in Global Cyberattack
In a massive global cyberattack, North Korean hackers infected a staggering 30,000 devices across over 100 countries, siphoning off a whopping $10.7 million in cryptocurrency. The brazen heist, which ran from December 2025 to July 2026, also compromised over 7,000 cryptocurrency wallets.
North Korea Targets 30,000 Devices in Global Crypto Heist
North Korean hackers have launched a massive global crypto heist, compromising over 30,000 devices in more than 100 countries and stealing at least $10.71 million in cryptocurrency. This staggering cybercrime spree has been uncovered by a joint advisory from top cybersecurity agencies worldwide.
North Korean Hackers Infect 30,000 Devices in Global Campaign
North Korean hackers have pulled off a massive global cyberattack, infecting 30,000 devices in over 100 countries and making off with millions in cryptocurrency. The financially motivated gang, known as WaterPlum, has been siphoning funds and account credentials from over 7,000 cryptocurrency wallets since December 2025.
North Korea Exploits Job Seekers to Infect 30,000 Devices
North Korean hackers have compromised over 30,000 devices by posing as recruiters, targeting unsuspecting job seekers with a clever ruse that steals sensitive information and cryptocurrency. By exploiting stolen IDs, these cybercriminals can impersonate victims and generate foreign currency, ultimately funding the regime.
US Military's Cyber Vulnerability Lies in Overlooked Infrastructure
Iranian hacking groups are using surprisingly simple yet effective tactics to wreak havoc on US critical infrastructure, businesses, and public services - and they don't need to be the most sophisticated players in the game to get results. By relying on volume, repeatability, and clear objectives, they're able to impose significant pain and disruption.