Tag: nation state
1338 articles
Hackers Exploit Dahua Devices via Credential Attacks and Auth Bypasses
Over 14,530 Dahua devices were compromised in a massive cyberattack, dubbed Operation CameraSwarm, which used credential attacks and authentication bypasses to gain control of cameras and other devices. The attackers hit hard in Ukraine and Russia, infiltrating devices via exposed credentials, flaws, and peer-to-peer relay tech.
China-linked SilkParasite campaign targets Central Asia with custom RATs
Meet SilkParasite, a sneaky espionage operation linked to China that's been targeting government bodies in Central Asia with a custom arsenal of Remote Access Tools. This sophisticated campaign boasts seven unique RAT families, five of which have never been seen before, and hints at AI-assisted development.
Medusa Ransomware Targets Over 500 Infrastructure Orgs, Expands Tactics
Medusa ransomware has hit a staggering 500+ critical infrastructure organizations, with healthcare being a prime target, as reported in a recent FBI advisory. The attacks are happening at an alarming rate, with exploitation windows as short as 24 hours or even less.
Medusa Ransomware Targets Over 500 US Critical Infrastructure Orgs
The Medusa ransomware gang has struck a staggering 500+ US critical infrastructure organizations across multiple sectors, including healthcare, defense, and finance, since June 2021. This alarming surge in attacks has prompted a joint warning from top US agencies, highlighting the urgent need for heightened cybersecurity measures.
US-South Korea Alliance Must Counter North Korea's Battlefield Gains
With President Donald Trump's call to "substantially reduce" joint military exercises with South Korea, the US-South Korea alliance faces a critical juncture that could fundamentally change how the two nations prepare for future conflicts. This sudden shift comes at a particularly challenging time, with factors like cost, diplomatic tensions, and Trump's rapport with Kim Jong Un influencing the decision.
Ukraine Develops Homegrown Glide Bomb to Counter Russian Threats
Meet the Equalizer, a game-changing glide bomb developed by Ukraine to take the fight to Russian forces, capable of striking targets dozens of kilometers behind enemy lines with a 250 kg warhead. This homegrown innovation was brought to life in just 17 months, thanks to the collaboration between DG Industry and Brave1, Ukraine's defense technology incubator.
Indonesia's China Exercise Exposes Non-Alignment Strategy Gaps
A simple "routine passing exercise" between Indonesia and China has sparked a heated diplomatic debate, revealing potential gaps in Indonesia's non-alignment strategy. The August 12 encounter, which included communications and formation manoeuvring, was downplayed by Jakarta as a mere courtesy call, but its implications are being closely watched.
US Recharges Indictment Against Iranian Hackers Tied to Mabna Institute
The US has ramped up its pursuit of justice against Iranian hackers, expanding an indictment to charge 17 individuals affiliated with the notorious Mabna Institute, which allegedly compromised over 100,000 professors' email accounts worldwide. This move marks a significant escalation in the case, with eight new defendants added to the original 2018 indictment.
US Military Tests 3D Printing in War Games to Bolster Pacific Supply Lines
In a high-intensity conflict in the Indo-Pacific, the US military could struggle to meet its repair and resupply needs - a challenge that 3D printing may help alleviate. The Navy recently tested an experimental 3D printing network during the Rim of the Pacific wargames to see if on-demand production could ease logistics in a potential Pacific conflict.
Medusa Ransomware Expands Reach with New Tactics, Hundreds More Victims
The Medusa ransomware gang is on the loose, exploiting unpatched software to target hundreds of victims across various sectors, with the Healthcare and Public Health industry being a frequent hit. Now, US agencies have issued an updated warning, detailing the group's latest tactics and partnerships.
India Expands Air Defense with Helicopter-Based Drone Interdiction Tactics
India is taking its air defense to new heights with cutting-edge helicopter-based drone interdiction tactics, recently putting its skills to the test in a week-long exercise at the Pokhran firing range in Rajasthan. The country is set to bolster its defense capabilities with 156 additional helicopter units by 2032.
Clop Ransomware Gang Crafts Custom Web Shell for Windchill Attacks
The Clop ransomware gang has taken its attacks to the next level by crafting a custom Java web shell that specifically targets PTC Windchill and FlexPLM servers, allowing them to harvest sensitive data with ease. This tailored tool is a significant evolution of their mass-exploitation tactics, making it a major concern for businesses using these applications.
Ransomware Attacks Singly Target Mid-Market Firms
Ransomware attacks are hitting mid-market firms with alarming frequency, and the threat is only escalating as AI-powered tools rapidly uncover new vulnerabilities at an overwhelming pace. Mid-market companies, with revenues between $10m and $1bn, now account for nearly three-quarters of ransomware attack victims.
US Scales Back South Korea Military Drills Amid Iran Spat
President Donald Trump just shook things up with a major military decision, announcing plans to scale back US participation in joint drills with South Korea - a move he justified by citing the country's long-standing protection by the US and a recent disagreement over an Iran operation. The reduced drills come courtesy of Trump's desire to cut costs and leverage his personal rapport with North Korea's Kim Jong Un.
BlackFile Targets Financial Firms in Ongoing Extortion Campaign
Financial firms are under attack by a relentless extortion group called BlackFile, which has been targeting the sector with alarming persistence since the start of the year. This threat actor has also set its sights on other industries, including med tech, with no signs of slowing down.
Iranian Hackers Evolve Cavern C2 with Google Apps Script Evasion
Meet the sneaky new tactic Iranian hackers are using to evade detection: blending malicious traffic with everyday services like Google Apps Script. By leveraging DNS A-record responses, they're able to switch between direct HTTPS channels and Google Apps Script relays, making it harder to track their moves.
Azure Breach Exposes 3.6 Million Records from Top Companies
A threat actor known as TheHatman is selling employee data from top companies like McDonald's and Tata Consultancy Services, allegedly stolen from Microsoft Azure tenants using compromised credentials. The stolen records total 3.6 million, with McDonald's alone accounting for 1.7 million employee records.
FBI Probes US Agency's Hire of North Korean IT Worker
A single hiring decision has sparked a federal investigation: a US federal agency, which hasn't been named, has been probed by the FBI for employing a remote IT worker from North Korea, a move that raises serious security concerns. This case highlights the limitations of traditional defenses in tackling sophisticated schemes involving foreign IT workers.
Nations Scramble to Verify AI Trustworthiness in Military Alliances
Imagine a world where AI systems can't agree on what's best for military alliances - a recent experiment by CSIS and Scale AI revealed that seven major AI models produced drastically different recommendations when faced with the same international crises. This eye-opening test exposed a harsh reality: AI trustworthiness is a major concern, with national biases and divergent judgments threatening to undermine military cooperation.
China APT Exploits VMware Flaw in Targeted Attacks
A recent investigation revealed that a suspected China-nexus APT group is actively exploiting a critical VMware vCenter vulnerability, CVE-2026-59310, to execute arbitrary code and deploy a backdoor, with ransomware seemingly used as a smokescreen to distract from the underlying intrusion. The attackers' true intentions appear to go beyond mere ransomware deployment.
Clop Ransomware Targets GE, Philips in Data Theft Attacks
Major companies like Philips, General Electric, and Shell are investigating claims by the Clop ransomware gang that their systems were breached, with Philips confirming a contained breach of an internal server that didn't affect customers. The incidents are a stark reminder of the growing threat of ransomware attacks on businesses.
Azure Breach Exposes Millions of Employee Records at Top Firms
A threat actor known as TheHatman is peddling a staggering 1.7 million employee records from McDonald's, along with millions more from other top firms, allegedly stolen from Microsoft Azure environments. The breach, which Hudson Rock deems highly authentic, has left giants like Vodafone, Tata Consultancy Services, and IHG Hotels & Resorts vulnerable.
Apple Alerts 110 Countries to Mercenary Spyware Threats
Apple just sounded the alarm for users in 110 countries, warning them they've been targeted by highly sophisticated mercenary spyware attacks that are among the most advanced digital threats out there. This latest alert is part of a multi-year effort to protect users, with notifications now sent to customers in over 150 countries.
Mustang Panda Upgrades CoolClient Backdoor with Signed Windows Rootkit
Meet the upgraded CoolClient backdoor, now armed with a signed Windows rootkit that lets it hide in plain sight, and a closer look reveals it's linked to the notorious HoneyMyte threat group, aka Mustang Panda. This sneaky malware has been targeting victims in Myanmar, Mongolia, Pakistan, and more.