APT & Threat Actors

Amazon attributes debug and chalk npm package hijacks to North Korea-linked actors who pushed wallet-draining scripts into popular packages.

Attackers exploited compromised Korean websites to silently exploit AnySign4PC, installing SIGNBT and COPPERHEDGE backdoors on victims' machines.

Autonomous Hermes AI agent used for espionage against Thailand's Ministry of Finance, facilitating data access and stealthy reconnaissance.

Russian state-linked actors exploited a Zimbra zero-day to steal emails and bypass MFA, prompting urgent patching and mitigations.

APT42 leverages AI-assisted reconnaissance and the resilient TAMECAT malware to target senior government and defense personnel.

U.S. agencies warn Iran-linked actors target Siemens, Schneider, and Rockwell ICS devices, detailing PLC compromise techniques impacting OT environments.

JadeProx China-linked cluster uses TriBack Loader to target government, healthcare, and education organizations in Asia and Latin America.

Russia-linked Laundry Bear leveraged a Zimbra zero-click vulnerability to steal emails, prompting international advisories and urgent patching.

UAC-0145 (Sandworm sub-cluster) uses ClickFix CAPTCHAs to trick Ukrainian targets into installing data-stealing malware.

Joint advisory warns state-sponsored actors are exploiting poorly secured routers across critical infrastructure, risking espionage and disruption.

GigaWiper backdoor includes wiper, ransomware encryption and multi-pass wiping commands for destructive sabotage and espionage.

Cisco Talos finds China-linked UAT-7810 expanding its ORB proxy network using new LONGLEASH malware targeting network devices.

Threat group O UNC 066 uses phone-based phishing to trick employees into registering attacker-controlled Entra passkeys to hijack accounts.

China-linked actors used a Roundcube exploit chain to compromise university physics and engineering departments and harvest credentials.