APT & Threat Actors

Brazilian threat group Breeze Comet targets financial systems to steal funds and disrupt operations across banks and payment processors.

NSO Group Pegasus used an iMessage zero-click exploit to infect a Serbian student activist's iPhone enabling remote surveillance.

Nimbus Manticore lures developers with fake coding tests to deliver cross-platform RATs (Node.js/JavaScript) for espionage.

Fire Ant compromised Cisco routers and the trust layer, using them to forward traffic, steal credentials, and blind logs.

Kaspersky links NodeRabbit malware to Iranian espionage campaigns targeting aviation and fintech developers in multiple countries.

U.S. agencies disrupted a China-linked hacking platform (QTFY) used against military and critical infrastructure, seizing infrastructure domains.

Iran-linked cyberattack on a UK power plant underscores vulnerabilities in critical national infrastructure and small energy assets.

Three suspected Russian espionage clusters abuse OAuth and WhatsApp linking to hijack accounts at academia, aerospace and governments.

Iran-linked attackers forced a UK power plant offline for four days, disrupting energy infrastructure operations.

Apple issued high-confidence threat notifications urging selected users to enable Lockdown Mode due to mercenary spyware targeting.

CISA ordered federal agencies to patch a Microsoft bug exploited in a long-running DPRK job-application campaign within two weeks.

Lazarus exploits AFD.sys zero-day (CVE-2026-68820) to deploy FudModule rootkit for stealthy kernel persistence.

Jewelbug APT operators run both state espionage and cryptocurrency theft from the same web control panel.

Microsoft issued massive Patch Tuesday fixes including multiple zero-days, with some exploited in nation-state campaigns.

Widening attacks against US water systems continue, targeting Internet-exposed PLCs; attribution reports suggest Iran-linked activity in some cases.

China-linked Storm-1175 deploys StormEncryptor ransomware, likely exploiting an N-able N-central vulnerability to gain initial access.

Microsoft warns China-linked actors are exploiting a critical flaw in N-able to deploy ransomware broadly as a launchpad.