Tag: nation state
1000 articles
Chinese hackers infiltrate telcos with Showboat, JFMBackdoor malware
Chinese-aligned hackers have been secretly infiltrating telecommunications providers across Asia Pacific and the Middle East since mid-2022, using sneaky malware like Showboat and JFMBackdoor to stay under the radar. They even used a clever "hide" command to conceal their digital footprints on infected machines.
Linux Rootkits Persist in Updated Forms
A single misstep with an over-privileged or poorly designed agent can quickly spiral into a serious incident, making the UK National Cyber Security Centre's warning feel alarmingly relevant. This urgency was underscored at Pwn2Own Berlin, where researchers exploited 47 zero-day flaws, raking in over $1.2 million in rewards.
Inactive User Account Enables Hackers to Control City's Water System
A simple mistake of leaving a former employee's user account active allowed hackers to take control of a city's water system, highlighting the importance of promptly disabling access for departed staff. This "zombie" account proved to be the vulnerable entry point that attackers exploited to wreak havoc on municipal operations.
Australia's North Targets Economic Security Boost with Hybrid Zone Model
Australia's north is poised for an economic security boost with a groundbreaking hybrid zone model that leverages its vast energy, critical minerals, and industrial capabilities. By unlocking the region's potential, Australia can supercharge its national power and create a brighter future.
Smaller Healthcare Providers Targeted in Rising Wave of Cyberattacks
Smaller healthcare providers are being hit hard by a rising wave of cyberattacks, with eight recent hacking incidents affecting nearly 2 million individuals. These breaches, impacting medical practices across the US, are a stark reminder that no healthcare organization is immune to the threat of cyber breaches.
Hackers Exploit SonicWall VPN Flaw to Bypass MFA
In a shocking exploit, hackers have successfully bypassed multi-factor authentication on SonicWall VPN devices, breaching security in as little as 30 minutes. ReliaQuest researchers detected the first in-the-wild exploitation of CVE-2024-12802, warning of a swift and stealthy threat.
Ukraine Cracks Down on Infostealer Operator Linked to 28,000 Stolen Accounts
Ukrainian cyberpolice, in collaboration with US law enforcement, have cracked down on an 18-year-old suspect behind a massive infostealer malware campaign that compromised 28,000 accounts, with over 5,800 used for fraudulent activities. The suspect allegedly ran the operation, selling stolen session data from a California online store between 2024 and 2025.
Android Malware Campaign Silently Invoices Users via Fake Apps
Malware hidden in nearly 250 fake Android apps has been silently invoicing users for premium services, with victims largely unaware of the charges. The sneaky campaign, dubbed Premium Deception, targeted subscribers in several countries, including Malaysia, Thailand, Romania, and Croatia, over a 10-month period.
Webworm Expands Arsenal with EchoCreep, GraphWorm Backdoors
Meet Webworm's latest tricks: EchoCreep and GraphWorm, two custom backdoors that let the China-aligned actor control and manipulate systems using unconventional channels like Discord and Microsoft Graph API. These new tools enable file uploads, downloads, and command execution, showcasing Webworm's creative approach to cyber threats.
Webworm APT Expands European Reach with Evolved Tactics
Meet Webworm, a China-aligned APT group that's now setting its sights on European governments and beyond, with a semi-opportunistic approach that's taken its targets to Belgium, Italy, Poland, Serbia, Spain, and even South Africa. This threat actor's evolved tactics signal a concerning expansion of its reach.
Iran War Fractures US-European Strategic Alliance
As US and Israeli strikes on Iran intensified, Spain's Prime Minister Pedro Sánchez boldly declared, We are a sovereign country that does not wish to take part in illegal wars, effectively shutting the door on US forces at Naval Station Rota and the Morón Air Base. This move sparked a stern warning from President Donald Trump, threatening a full trade embargo on Spain.
US Special Ops to Test AC-130J Gunship with Advanced Cruise Missiles and Radar
US Special Operations Command is set to supercharge the AC-130J Ghostrider gunship with advanced cruise missiles and radar, boosting its firepower to strike targets over 400 miles away. The upgrade, part of the Precision Strike Package, promises to dramatically expand the aircraft's combat reach.
CISA Credentials Exposed in GitHub Leak
A security researcher has uncovered a public GitHub repository exposing sensitive credentials tied to the Cybersecurity and Infrastructure Security Agency, sparking fears that malicious actors could exploit the data for nefarious purposes. The leak, linked to a contractor-maintained repository called "Private-CISA," reportedly included privileged AWS GovCloud accounts and internal CISA systems.
Ukraine Unleashes 600 Drones in Deep Strike Against Moscow Infrastructure
In a daring move, Ukraine launched a massive drone strike, deploying nearly 600 unmanned aerial vehicles to target key Russian infrastructure, including oil facilities, a microelectronics hub, and military bases, across 14 regions deep within enemy territory. The unprecedented attack, which hit sites in Moscow Oblast, Zelenograd, Ryazan, and occupied Crimea, marks a significant escalation in Ukraine's fight against Russia.
Cyberwar Expands to Orbit as Satellites Become New Front
The lines between space and cyber are blurring, and the threat landscape for satellites and other space systems is evolving at a breakneck pace. As space systems become increasingly intertwined with cyberspace, eroding norms are leaving them vulnerable to attacks, as seen in the Russians' 2022 cyberattack on a US commercial satellite system, Viasat, at the start of their invasion of Ukraine.
AI Models Force Government to Rethink Cybersecurity Risks
The government's approach to cybersecurity is at a critical reflection point, thanks to advanced AI models like Anthropic's Mythos, which present both risks and opportunities for agencies handling sensitive information. Collaboration between the government and vendors is crucial to navigate this new landscape.
Microsoft Vulnerabilities Spike in Critical Areas
A single critical flaw, like CVE-2025-55241, can give attackers unrestricted access to any tenant, highlighting the alarming rise in critical Microsoft vulnerabilities, which doubled in 2025 despite a stable overall number of vulnerabilities. This sharp increase in high-impact weaknesses demands attention and action.
OAuth Grants Expose Hidden Risk Below MFA Perimeter
In just five weeks, a phishing-as-a-service platform called EvilTokens compromised over 340 Microsoft 365 organizations across five countries by exploiting a clever trick: instead of stealing passwords, it convinced users to hand over OAuth refresh tokens, granting attackers long-term access to sensitive data like mailboxes, drives, and calendars. This sneaky tactic allowed hackers to bypass traditional security measures, including multi-factor authentication.
GitHub Actions Supply Chain Attack Exfiltrates CI/CD Credentials
A sneaky supply chain attack on GitHub Actions has led to the theft of CI/CD credentials, with hackers using a clever trick to redirect tags to fake commits that hide malicious code. By masquerading as legitimate commits, attackers were able to execute arbitrary code and evade pull request reviews.
US, Israel Escalate Pressure on Iran with Airstrikes, Sanctions
President Donald Trump revealed on Truth Social that he was asked by top Middle Eastern leaders to delay a planned military attack on Iran, which was set to happen the following day. He instructed the military to stand down, but remain ready to launch a full-scale assault if negotiations fail.
China's Influence in Solomons Resists Leadership Shift
Solomon Islands' new Prime Minister Matthew Wale is vowing to shake things up, warning that his country isn't immune to geopolitics and promising that "change is coming" after ousting his pro-China predecessor. Will this leadership shift mark a new direction for the island nation, one that's less aligned with Beijing?
SHub Infostealer Variant Reaper Exploits macOS Security Updates
Researchers at SentinelOne have uncovered a sneaky new variant of the SHub macOS infostealer, called Reaper, which cleverly bypasses Apple's latest security updates by using a malicious AppleScript to trick users. This crafty malware uses fake installers to lure victims in, making it a serious threat to macOS users.
Fast16 Malware Targeted Nuclear Weapons Simulations Pre-Stuxnet
Meet the fast16 malware, a highly targeted threat that sabotaged nuclear weapons simulations by corrupting results in popular engineering tools LS-DYNA and AUTODYN, but only when conditions reached explosive intensities. Its creators fine-tuned it to strike with surgical precision.
China's PLA Adopts Antiquated Homing Pigeons for Battlefield Communications
In a surprising move, China's PLA Logistics Support Force has turned to an unlikely communication solution: homing pigeons, proudly showcased on state television as a key part of their battlefield communications toolkit. These birds are being used to deliver messages, bringing a touch of nostalgia to modern warfare.