APT & Threat Actors

US agencies seized domains and disrupted tools tied to Integrity Technology Group and Flax Typhoon used against critical infrastructure.

UK NCSC and partners publish advisory calling out China-linked actors targeting sensitive data across multiple sectors worldwide.

Belarusian Cyber Partisans reportedly conducted a two-year espionage campaign within Russian healthcare networks for intel and disruption.

MI5 warns UK academics about contributions to China General Technology Research Institute tied to potential espionage concerns.

A North Korea-linked campaign hides control-server locations inside Ethereum transfers to keep malware connected to operators.

Bitget confirmed a hot/warm wallet compromise with approximately $351.6M stolen; suspected nation-state links reported.

Japan dismantled a North Korean laptop farm; allied report details WaterPlum campaign and large-scale credential theft.

North Korean-linked Jade Sleet used FLATROOF and ROOFDECK backdoors to compromise an India-based IT services provider.

Volexity observes UTA0565 exploiting Chrome and Microsoft defects with a shared exploit kit across China-aligned groups.

SideCopy uses spear-phishing and mshta.exe to deliver ReverseRAT, targeting Indian academic institutions for espionage.

WaterPlum/Contagious campaign compromised ~30,000 devices and siphoned funds or credentials from 7,000 crypto wallets.

Advisory links WaterPlum to at least 30,000 infected devices worldwide and over $10.7 million in stolen crypto transfers.

SilkParasite espionage infrastructure traced across Central Asia, using spear-phishing and trusted Windows programs to deploy RATs.

FamousSparrow uses new SparroWocky backdoor to conduct espionage against government targets in Latin America, enabling persistent access.

Sandworm chains Cisco vulnerabilities to deploy an upgraded Cyclops Blink botnet, reviving disrupted infrastructure-takeover tooling.

China-linked actors chained Chrome and Windows flaws to deploy GRIMWEDGE JavaScript backdoor against NGOs; validate browser and OS patching.