Latest Cyber-espionage news

Chinese Cyberspies Employ Ransomware in Attacks for Diversion

Cyberespionage groups have been using ransomware as a tactic to make attack attribution more challenging, distract defenders, or for a financial reward as a secondary goal to data theft.
- Bill Toulas
- June 27, 2024
- 12:20 AM
- 1
UNC3886 hackers use Linux rootkits to hide on VMware ESXi VMs

A suspected Chinese threat actor tracked as UNC3886 uses publicly available open-source rootkits named 'Reptile' and 'Medusa' to remain hidden on VMware ESXi virtual machines, allowing them to conduct credential theft, command execution, and lateral movement.
- Bill Toulas
- June 20, 2024
- 01:46 PM
- 0
Hackers use F5 BIG-IP malware to stealthily steal data for years

A group of suspected Chinese cyberespionage actors named 'Velvet Ant' are deploying custom malware on F5 BIG-IP appliances to gain a persistent connection to the internal network and steal data.
- Bill Toulas
- June 17, 2024
- 01:37 PM
- 2
Chinese hackers breached 20,000 FortiGate systems worldwide

The Dutch Military Intelligence and Security Service (MIVD) warned today that the impact of a Chinese cyber-espionage campaign unveiled earlier this year is "much larger than previously known."
- Sergiu Gatlan
- June 11, 2024
- 12:22 PM
- 3
Chinese hacking groups team up in cyber espionage campaign

Chinese state-sponsored actors have been targeting a government agency since at least March 2023 in a cyberespionage campaign that researchers track as Crimson Palace
- Bill Toulas
- June 05, 2024
- 04:06 PM
- 0
Chinese hackers hide on military and govt networks for 6 years

A previously unknown threat actor dubbed "Unfading Sea Haze" has been targeting military and government entities in the South China Sea region since 2018, remaining undetected all this time.
- Bill Toulas
- May 22, 2024
- 09:25 AM
- 0
Kimsuky hackers deploy new Linux backdoor in attacks on South Korea

The North Korean hacker group Kimsuki has been using a new Linux malware called Gomir that is a version of the GoBear backdoor delivered via trojanized software installers.
- Bill Toulas
- May 16, 2024
- 09:28 AM
- 1
Iranian hackers pose as journalists to push backdoor malware

The Iranian state-backed threat actor tracked as APT42 is employing social engineering attacks, including posing as journalists, to breach corporate networks and cloud environments of Western and Middle Eastern targets.
- Bill Toulas
- May 04, 2024
- 10:17 AM
- 0
NSA warns of North Korean hackers exploiting weak DMARC email policies

The NSA and FBI warned that the APT43 North Korea-linked hacking group exploits weak email Domain-based Message Authentication Reporting and Conformance (DMARC) policies to mask spearphishing attacks.
- Sergiu Gatlan
- May 03, 2024
- 03:16 PM
- 2
ArcaneDoor hackers exploit Cisco zero-days to breach govt networks

Cisco warned today that a state-backed hacking group has been exploiting two zero-day vulnerabilities in Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls since November 2023 to breach government networks worldwide.
- Sergiu Gatlan
- April 24, 2024
- 01:07 PM
- 0
Russian Sandworm hackers pose as hacktivists in water utility breaches

The Sandworm hacking group associated with Russian military intelligence has been hiding attacks and operations behind multiple online personas posing as hacktivist groups.
- Bill Toulas
- April 17, 2024
- 01:08 PM
- 0
Russian hackers target German political parties with WineLoader malware

Researchers are warning that a notorious hacking group linked to Russia's Foreign Intelligence Service (SVR) is targeting political parties in Germany for the first time, shifting their focus away from the typical targeting of diplomatic missions.
- Bill Toulas
- March 22, 2024
- 03:27 PM
- 1
North Korea hacks two South Korean chip firms to steal engineering data

The National Intelligence Service (NIS) in South Korea warns that North Korean hackers target domestic semiconductor manufacturers in cyber espionage attacks.
- Bill Toulas
- March 04, 2024
- 09:46 AM
- 0
U.S. charges Iranian for hacks on defense orgs, offers $10M for info

The U.S. Department of Justice (DoJ) has unveiled an indictment against Alireza Shafie Nasab, a 39-year-old Iranian national, for his role in a cyber-espionage campaign targeting U.S. government and defense entities.
- Bill Toulas
- March 01, 2024
- 09:47 AM
- 0
North Korean hackers linked to defense sector supply-chain attack

In an advisory today Germany's federal intelligence agency (BfV) and South Korea's National Intelligence Service (NIS) warn of an ongoing cyber-espionage operation targeting the global defense sector on behalf of the North Korean government.
- Bill Toulas
- February 19, 2024
- 03:24 PM
- 0
FBI disrupts Russian Moobot botnet infecting Ubiquiti routers

The FBI took down a botnet of small office/home office (SOHO) routers used by Russia's Main Intelligence Directorate of the General Staff (GRU) to proxy malicious traffic and to target the United States and its allies in spearphishing and credential theft attacks.
- Sergiu Gatlan
- February 15, 2024
- 01:00 PM
- 3
Chinese hackers infect Dutch military network with malware

A Chinese cyber-espionage group breached the Dutch Ministry of Defence last year and deployed malware on compromised devices, according to the Military Intelligence and Security Service (MIVD) of the Netherlands.
- Sergiu Gatlan
- February 06, 2024
- 01:49 PM
- 0
Blackwood hackers hijack WPS Office update to install malware

A previously unknown advanced threat actor tracked as 'Blackwood' is using sophisticated malware called NSPX30 in cyberespionage attacks against companies and individuals.
- Bill Toulas
- January 25, 2024
- 03:30 PM
- 0
Chinese hackers exploit VMware bug as zero-day for two years

A Chinese hacking group has been exploiting a critical vCenter Server vulnerability (CVE-2023-34048) as a zero-day since at least late 2021.
- Sergiu Gatlan
- January 19, 2024
- 11:32 AM
- 0
Ivanti Connect Secure zero-days exploited to deploy custom malware

Hackers have been exploiting the two zero-day vulnerabilities in Ivanti Connect Secure disclosed this week since early December to deploy multiple families of custom malware for espionage purposes.
- Bill Toulas
- January 12, 2024
- 10:30 AM
- 0