Tag: nation state
1340 articles
Ghostwriter Exploits Ukraine Government with Prometheus Phishing Malware
Malicious actors known as Ghostwriter have launched a cunning phishing campaign targeting Ukraine's government, using emails that appear to come from trusted sources and contain links to a seemingly harmless learning platform, Prometheus. These emails contain a hidden threat that can download malware onto victims' devices.
Nation-State Actors Exploit ROADtools in Cloud Attacks
Cloud attackers are now leveraging ROADtools, a publicly available toolkit, to exploit vulnerabilities in cloud tenants, allowing them to persist, discover, and evade defenses with ease. This dual-use framework's ability to speak Entra ID and Microsoft Graph makes it a red flag for defenders to take notice.
Iran-nexus APT Expands Espionage Ops with New RAT Variants
Unit 42 researchers have uncovered a sophisticated espionage campaign by an Iran-linked threat group, dubbed Screening Serpens, which has deployed six new remote access Trojan (RAT) variants to target entities across the US, Israel, and the Middle East. These variants, part of two distinct malware families, signal a significant expansion of the group's cyber spying operations.
US Navy Bolsters Submarine Detection with Next-Gen Sonobuoys
The US Navy is stepping up its submarine detection game with cutting-edge sonobuoys, driven by the growing threat of quieter enemy subs operated by China and Russia. These advanced floating sensors, weighing in at just 30 pounds, pack a powerful punch in precision sensing to help the Navy stay one step ahead.
Chinese hackers infiltrate telcos with Showboat, JFMBackdoor malware
Chinese-aligned hackers have been secretly infiltrating telecommunications providers across Asia Pacific and the Middle East since mid-2022, using sneaky malware like Showboat and JFMBackdoor to stay under the radar. They even used a clever "hide" command to conceal their digital footprints on infected machines.
Linux Rootkits Persist in Updated Forms
A single misstep with an over-privileged or poorly designed agent can quickly spiral into a serious incident, making the UK National Cyber Security Centre's warning feel alarmingly relevant. This urgency was underscored at Pwn2Own Berlin, where researchers exploited 47 zero-day flaws, raking in over $1.2 million in rewards.
Inactive User Account Enables Hackers to Control City's Water System
A simple mistake of leaving a former employee's user account active allowed hackers to take control of a city's water system, highlighting the importance of promptly disabling access for departed staff. This "zombie" account proved to be the vulnerable entry point that attackers exploited to wreak havoc on municipal operations.
Australia's North Targets Economic Security Boost with Hybrid Zone Model
Australia's north is poised for an economic security boost with a groundbreaking hybrid zone model that leverages its vast energy, critical minerals, and industrial capabilities. By unlocking the region's potential, Australia can supercharge its national power and create a brighter future.
Smaller Healthcare Providers Targeted in Rising Wave of Cyberattacks
Smaller healthcare providers are being hit hard by a rising wave of cyberattacks, with eight recent hacking incidents affecting nearly 2 million individuals. These breaches, impacting medical practices across the US, are a stark reminder that no healthcare organization is immune to the threat of cyber breaches.
Hackers Exploit SonicWall VPN Flaw to Bypass MFA
In a shocking exploit, hackers have successfully bypassed multi-factor authentication on SonicWall VPN devices, breaching security in as little as 30 minutes. ReliaQuest researchers detected the first in-the-wild exploitation of CVE-2024-12802, warning of a swift and stealthy threat.
Ukraine Cracks Down on Infostealer Operator Linked to 28,000 Stolen Accounts
Ukrainian cyberpolice, in collaboration with US law enforcement, have cracked down on an 18-year-old suspect behind a massive infostealer malware campaign that compromised 28,000 accounts, with over 5,800 used for fraudulent activities. The suspect allegedly ran the operation, selling stolen session data from a California online store between 2024 and 2025.
Android Malware Campaign Silently Invoices Users via Fake Apps
Malware hidden in nearly 250 fake Android apps has been silently invoicing users for premium services, with victims largely unaware of the charges. The sneaky campaign, dubbed Premium Deception, targeted subscribers in several countries, including Malaysia, Thailand, Romania, and Croatia, over a 10-month period.
Webworm Expands Arsenal with EchoCreep, GraphWorm Backdoors
Meet Webworm's latest tricks: EchoCreep and GraphWorm, two custom backdoors that let the China-aligned actor control and manipulate systems using unconventional channels like Discord and Microsoft Graph API. These new tools enable file uploads, downloads, and command execution, showcasing Webworm's creative approach to cyber threats.
Webworm APT Expands European Reach with Evolved Tactics
Meet Webworm, a China-aligned APT group that's now setting its sights on European governments and beyond, with a semi-opportunistic approach that's taken its targets to Belgium, Italy, Poland, Serbia, Spain, and even South Africa. This threat actor's evolved tactics signal a concerning expansion of its reach.
Iran War Fractures US-European Strategic Alliance
As US and Israeli strikes on Iran intensified, Spain's Prime Minister Pedro Sánchez boldly declared, We are a sovereign country that does not wish to take part in illegal wars, effectively shutting the door on US forces at Naval Station Rota and the Morón Air Base. This move sparked a stern warning from President Donald Trump, threatening a full trade embargo on Spain.
US Special Ops to Test AC-130J Gunship with Advanced Cruise Missiles and Radar
US Special Operations Command is set to supercharge the AC-130J Ghostrider gunship with advanced cruise missiles and radar, boosting its firepower to strike targets over 400 miles away. The upgrade, part of the Precision Strike Package, promises to dramatically expand the aircraft's combat reach.
CISA Credentials Exposed in GitHub Leak
A security researcher has uncovered a public GitHub repository exposing sensitive credentials tied to the Cybersecurity and Infrastructure Security Agency, sparking fears that malicious actors could exploit the data for nefarious purposes. The leak, linked to a contractor-maintained repository called "Private-CISA," reportedly included privileged AWS GovCloud accounts and internal CISA systems.
Ukraine Unleashes 600 Drones in Deep Strike Against Moscow Infrastructure
In a daring move, Ukraine launched a massive drone strike, deploying nearly 600 unmanned aerial vehicles to target key Russian infrastructure, including oil facilities, a microelectronics hub, and military bases, across 14 regions deep within enemy territory. The unprecedented attack, which hit sites in Moscow Oblast, Zelenograd, Ryazan, and occupied Crimea, marks a significant escalation in Ukraine's fight against Russia.
Cyberwar Expands to Orbit as Satellites Become New Front
The lines between space and cyber are blurring, and the threat landscape for satellites and other space systems is evolving at a breakneck pace. As space systems become increasingly intertwined with cyberspace, eroding norms are leaving them vulnerable to attacks, as seen in the Russians' 2022 cyberattack on a US commercial satellite system, Viasat, at the start of their invasion of Ukraine.
AI Models Force Government to Rethink Cybersecurity Risks
The government's approach to cybersecurity is at a critical reflection point, thanks to advanced AI models like Anthropic's Mythos, which present both risks and opportunities for agencies handling sensitive information. Collaboration between the government and vendors is crucial to navigate this new landscape.
Microsoft Vulnerabilities Spike in Critical Areas
A single critical flaw, like CVE-2025-55241, can give attackers unrestricted access to any tenant, highlighting the alarming rise in critical Microsoft vulnerabilities, which doubled in 2025 despite a stable overall number of vulnerabilities. This sharp increase in high-impact weaknesses demands attention and action.
OAuth Grants Expose Hidden Risk Below MFA Perimeter
In just five weeks, a phishing-as-a-service platform called EvilTokens compromised over 340 Microsoft 365 organizations across five countries by exploiting a clever trick: instead of stealing passwords, it convinced users to hand over OAuth refresh tokens, granting attackers long-term access to sensitive data like mailboxes, drives, and calendars. This sneaky tactic allowed hackers to bypass traditional security measures, including multi-factor authentication.
GitHub Actions Supply Chain Attack Exfiltrates CI/CD Credentials
A sneaky supply chain attack on GitHub Actions has led to the theft of CI/CD credentials, with hackers using a clever trick to redirect tags to fake commits that hide malicious code. By masquerading as legitimate commits, attackers were able to execute arbitrary code and evade pull request reviews.
US, Israel Escalate Pressure on Iran with Airstrikes, Sanctions
President Donald Trump revealed on Truth Social that he was asked by top Middle Eastern leaders to delay a planned military attack on Iran, which was set to happen the following day. He instructed the military to stand down, but remain ready to launch a full-scale assault if negotiations fail.