logo

News related to
espionage

A China-linked cyber-espionage group has expanded its use of hijacked devices to mask attacks on telecommunications infrastructure, deploying three newly documented malware implants across Windows, Linux and network edge systems. The activity, tracked as UAT-9244, has targeted critical telecoms infrastructure in South America since 2024. The campaign shows how state-aligned operators are moving beyond direct server compromise to build distributed relay networks that help them scan, brute-force […]

A newly identified cyber-espionage group has targeted government agencies and electricity-sector organisations in Russia, Brazil and Kazakhstan, using phishing emails to deploy a Windows information stealer designed to extract credentials, documents and browser data. The group, named Armored Likho and provisionally linked to a cluster known as Eagle Werewolf, has emerged as a notable threat because its operations combine espionage against institutions with financially motivated attacks against […]

Opera has rolled out Paste Protect, a built-in browser defence designed to stop malicious clipboard commands before users can paste them into terminals, run boxes or other command-line tools. The feature, launched on 2 July 2026 and switched on by default in Opera’s desktop browsers, targets a fast-growing class of social engineering attacks known as ClickFix. These scams usually begin with a familiar-looking prompt: a failed video […]

Anthropic has restored limited access to Claude Mythos 5 for selected U. S. organisations involved in protecting critical infrastructure, easing a two-week suspension that had disrupted cybersecurity work across major companies and public-sector partners. The decision allows more than 100 vetted organisations to resume use of the company’s most advanced cyber-focused artificial intelligence model. The approved users are understood to include major enterprises, government-linked agencies and institutions […]

State-backed hacking groups are increasingly borrowing ransomware tactics to conceal cyber-espionage campaigns, with Iran-linked MuddyWater emerging as a prominent example of a wider shift blurring the boundary between criminal extortion and intelligence operations. NCC Group has warned that threat actors tied to governments are using ransomware branding, extortion notes, victim leak sites and negotiation channels not only to increase pressure on targets but also to complicate attribution. […]

AryStinger, a newly analysed botnet family, has compromised more than 4,000 outdated routers and begun turning ageing network devices into covert infrastructure for reconnaissance, intranet scanning and traffic tunnelling. The campaign highlights a shift in botnet use from crude denial-of-service activity towards stealthier pre-intrusion work, where hijacked routers and network-attached storage appliances act as relay points between attackers and intended targets. Security analysts say the malware helps […]

Brussels has moved to assess the fallout from Washington’s order cutting foreign users off from Anthropic’s most powerful artificial intelligence models, turning a corporate shutdown into a test of allied trust in critical digital infrastructure. The European Commission is examining the practical consequences for users across the bloc after Anthropic disabled Fable 5 and Mythos 5, saying it had received a US export-control directive barring access by […]

Advertisements

A China-nexus hacking group maintained covert access to a segregated critical-infrastructure network for nearly a decade by tampering with Linux authentication tools that administrators rely on to control access. The operation, tracked as Velvet Ant and labelled Operation Highland by investigators, exposed a high-risk tactic in cyber espionage: rather than relying only on conventional malware, the intruders replaced trusted OpenSSH binaries and Pluggable Authentication Modules with altered […]

Russian military-linked hackers tracked as APT28 have shifted cyber operations into compromised internet routers, using the MooBot botnet and vulnerable edge devices to harvest credentials, route traffic and host malicious tools across dispersed global infrastructure. The technique marks an operational evolution for the group, also known as Fancy Bear, Sofacy, Forest Blizzard and Pawn Storm. Long associated with intelligence collection against NATO governments, Ukraine, defence contractors, political […]

Attackers are increasingly abusing legitimate system utilities and widely used administrative tools to deliver malware, move through networks and avoid detection, forcing security teams to rethink defences built mainly around blocking suspicious files. The tactic, commonly described as “living off the land”, relies on trusted tools already present inside corporate environments. PowerShell, Windows Management Instrumentation, certutil, mshta, rundll32, regsvr32, scheduled tasks, remote monitoring software and JavaScript execution […]

Cybersecurity teams are being urged to review exposed Microsoft IIS servers after a China-linked espionage cluster was found using a custom web shell framework built to evade conventional detection and maintain access inside compromised networks. The activity, tracked as OP-512, targeted an internet-facing Windows Server 2016 system running Internet Information Services and an end-of-life. NET Framework 4.0 application. The operation involved three purpose-built web shells using ASPX […]

A China-linked cyber-espionage group tracked as VerdantBamboo has been tied to a BRICKSTORM malware operation targeting Linux-based virtual appliances, firewalls and enterprise infrastructure, sharpening concerns over the security of systems that often sit outside mainstream endpoint monitoring. The activity came to light after suspicious traffic was detected from a Linux-based virtual machine appliance during an incident response investigation. The inquiry found that attackers had used stolen administrative […]

Amazon MGM Studios and Amazon Games are set to take a larger role in future James Bond video games, shifting the franchise away from the self-publishing model used by IO Interactive for 007 First Light and placing the next stage of Bond’s gaming strategy more firmly under Amazon’s expanding entertainment empire. The move follows Amazon MGM Studios’ acquisition of creative control over the James Bond franchise in […]

Cybercriminal groups are shifting phishing campaigns from fake login pages to malware-led intrusions that silently extract passwords, browser cookies, session tokens, cryptocurrency wallet data and other sensitive information from infected devices. The change marks a significant turn in online fraud tactics. Classic phishing pages still imitate banks, cloud services, delivery firms and workplace platforms, but attackers are increasingly using emails, search ads, fake software installers, messaging apps […]

Cyber espionage operators are using a newly documented Windows backdoor called HazyBeacon to target government networks in Southeast Asia, turning legitimate Amazon Web Services infrastructure into a covert command-and-control channel that can blend into ordinary cloud traffic. The activity, tracked as CL-STA-1020, has been linked to intelligence-gathering operations focused on sensitive state information, including material tied to tariffs, trade disputes and government policy discussions. Security researchers have […]

Moscow’s main security agency said it had uncovered a foreign intelligence operation that placed spyware on mobile phones used by senior officials, intensifying Russia’s long-running confrontation with Western governments over cyber espionage, communications security and control of digital infrastructure. Russia’s Federal Security Service said the operation involved the compromise of thousands of devices, including phones used by officials, diplomats and people linked to government agencies. The agency […]

Palo Alto Networks customers are facing renewed pressure to patch internet-facing security systems after attackers began exploiting a high-severity authentication bypass flaw in PAN-OS GlobalProtect, a product widely used to provide remote access to corporate networks. The vulnerability, tracked as CVE-2026-0257, affects GlobalProtect portal and gateway deployments in PAN-OS where authentication override cookies are enabled alongside a specific certificate configuration. Successful exploitation can allow a remote attacker […]

Hackers are using targeted spearphishing emails to deploy AZUREVEIL, an Adaptix-based command-and-control agent, against government and enterprise-linked targets in the Czech Republic and Taiwan, underscoring the growing use of trusted cloud services to mask cyber-espionage activity. The campaign, tracked as Operation Dragon Weave, begins with a malicious ZIP archive carrying files designed to appear as official documents. Once opened, the archive can trigger a multi-stage infection chain […]

SolyxImmortal, a Python-based information-stealing malware, is drawing attention from cyber defenders because of its ability to combine browser credential theft, document harvesting, keystroke logging and screen surveillance inside a single Windows implant. Technical analysis shows the malware is designed to operate quietly on compromised machines, using common Python libraries, Windows features and multi-threaded execution to run several data-collection functions at the same time. Its targets include saved […]

A destructive cyber campaign tied to Iran-linked operators has targeted organisations in the Middle East and abroad, deleting virtual machines, databases, partitions and backup repositories in attacks designed to cripple recovery as well as disrupt daily operations. The activity has been linked by forensic investigators to infrastructure and tactics associated with Black Shadow, a long-running threat group assessed by Israeli authorities and private researchers as operating on […]

Russia-linked cyber operators tracked as GREYVIBE have used generative artificial intelligence tools including ChatGPT and Google Gemini to widen cyber-espionage operations against Ukraine-linked targets, signalling a shift in how lower-skilled threat groups can build lures, malware and infrastructure at speed. The activity, active since at least August 2025, has targeted military, government, civilian and business-related organisations through phishing emails, fake verification pages, fraudulent websites and custom malware. […]

China-linked hacking groups have used the Middle East war to intensify cyber-espionage attempts against maritime, energy and political targets across the Gulf, exposing how regional conflict is being turned into an intelligence-gathering opportunity for rival powers. The activity, tracked between October 2025 and March 2026, shows threat actors aligned with Beijing moving quickly around geopolitical shocks, particularly after the escalation involving Iran from late February. Maritime affairs, […]

Roundcube Webmail administrators are being pressed to install emergency updates after maintainers fixed a set of security flaws that could expose email systems to database manipulation, script injection, server-side request forgery and other attacks. Versions 1.6.16 and 1.7.1, released on 24 May 2026, address vulnerabilities affecting the 1.6 long-term support line and the 1.7 branch. The most closely watched issue is a pre-authentication SQL injection flaw in […]

Hackers are exploiting shared content delivery network infrastructure to hide malicious traffic behind trusted domains, exposing a weakness in DNS-based security controls used by enterprises to block command-and-control activity, data theft and unauthorised tunnelling. The technique, named Underminr by ADAMnetworks, takes advantage of the way large CDNs host many unrelated websites on the same edge IP addresses. A compromised device can make a legitimate DNS lookup for […]

VISHNU RAJA
RYO YAMADA
HITORI GOTOH
IKUYO KITA
Just in:
High Court opens toddy shop jobs to women // Lancet researchers seek global health emergency recognition for climate // 10 CENTS CAPITAL Completes US$20 Million Financing and Sets Out a Phased Deployment Plan // ZJLD Group Returns to Hong Kong Wine & Dine Festival 2026 // Sharjah Islamic Bank’s $500 million sukuk joins Nasdaq Dubai // Hill’s Enhances Cat and Dog Food with Prebiotics to Support Senior Pet Health in Hong Kong // PSC probe closes in on chief // Anchored in Data Sovereignty, the Engagement Enables the Legal Sector to Adopt Generative AI Safely and Confidently // Mumbai to host global blockchain leaders at November conference // PSC probe closes in on Chairman // 10 CENTS CAPITAL Completes US$20 Million Financing and Sets Out a Phased Deployment Plan // Crown Workspace wins Gold and special Trinity recognition at HR Vendors of the Year Awards 2026 // US intelligence suspects Megaspeed executive of Chinese espionage // New authentication research charts shift away from passwords // Lancet researchers seek global health emergency recognition for climate // Ex-Kochi police chief rejects judicial interference // Lancet researchers seek global health emergency recognition for climate // US intelligence suspects Megaspeed executive of Chinese espionage // Polymarket restores trading after third-party security breach // Lancet researchers seek global health emergency recognition for climate //