logo

News related to
espionage

A targeted cyber-espionage campaign has struck China’s higher education sector, using deceptive PDF-style shortcut files to install Cobalt Strike beacons on victim machines and open a path for remote control. The operation, labelled Dragon Whistle, has focused on Changzhou University and related academic users by exploiting a familiar administrative pressure point: compulsory student fitness testing tied to the 2026 National Student Physical Fitness and Health Standards. The […]

North Korea-linked hackers have upgraded the InvisibleFerret malware to bypass script-based security tools, converting its Python code into compiled modules that are harder for defenders to inspect and block. The campaign is attributed to Void Dokkaebi, also tracked as Famous Chollima, a threat group associated with operations against software developers, cryptocurrency firms and technology workers. The latest version uses Cython-compiled files, appearing as. pyd modules on Windows […]

Hackers are turning Middle East telecoms and hosting networks into a major command-and-control layer, exposing a regional cyber risk that now extends beyond compromised devices to the infrastructure patterns that sustain attacks. A three-month mapping of malicious activity between 1 February and 1 May identified more than 1,350 active C2 servers across 98 infrastructure providers in 14 countries, including Saudi Arabia, the UAE, Turkey, Israel, Iraq, Iran, […]

Ukrainian state bodies are facing a sustained phishing campaign by the Russia-linked Gamaredon group, with attackers using weaponised WinRAR archives to deploy GammaDrop and GammaLoad malware in a multi-stage espionage operation aimed at government networks. The campaign, active since September 2025 and still evolving, has targeted Ukrainian state institutions through spoofed messages and compromised government email accounts. The emails are written in Ukrainian and designed to resemble […]

A suspected China-linked hacking group attempted to breach the India operations of a global manufacturer using TencShell, a previously undocumented malware implant built from an open-source command-and-control framework and adapted for stealthy enterprise intrusion. The attempted compromise, detected in April 2026, centred on a third-party user connected to the manufacturer’s environment, underscoring the growing security risks created by supplier, contractor and partner access. The attack was blocked […]

Iran-linked cyber-espionage operators have used trusted, digitally signed software components to breach organisations across four continents, widening concerns over state-backed campaigns that hide inside legitimate enterprise tools. Seedworm, also tracked as MuddyWater, Temp Zagros, Static Kitten and Mango Sandstorm, has been linked to intrusions affecting at least nine organisations in early 2026. The victims included a major South Korean electronics manufacturer, public-sector bodies, an international airport in […]

Cybersecurity teams are tracking a stealthy espionage-style malware operation that uses GitHub Releases to hide a Python-based infostealer behind humanitarian-themed phishing material aimed at Russian-speaking targets. The campaign, tracked as Operation HumanitarianBait, begins with phishing emails carrying a RAR archive that contains a malicious Windows shortcut file. The lure presents itself as a Russian-language humanitarian aid request or application form, exploiting a sensitive social context while keeping […]

Advertisements

Windows users seeking Claude-branded desktop tools have been targeted by a fake Anthropic-themed website distributing Beagle, a previously undocumented backdoor delivered through a DLL sideloading chain that gives attackers remote control over infected machines. The campaign used the domain claude-pro[.]com to imitate Claude’s official interface and lure visitors into downloading a supposed Claude-Pro Relay installer aimed at developers working with Claude Code. The fraudulent site copied the […]

Cybersecurity researchers have identified a targeted espionage-style malware campaign that uses GitHub Releases to conceal payload delivery, combining phishing, trusted cloud infrastructure and a fileless Python implant to steal sensitive data from Windows systems. The operation, tracked as Operation HumanitarianBait, begins with phishing emails carrying a malicious Windows shortcut file inside a RAR archive. The lure is built around Russian-language humanitarian aid material, including what appears to […]

Cybersecurity investigators have linked a Microsoft Teams-based credential theft operation to MuddyWater, the state-sponsored threat group associated with Iran’s intelligence apparatus, after an intrusion first presented itself as an ordinary Chaos ransomware attack. The operation, detected in early 2026 and detailed this week, shows how trusted workplace collaboration tools are being turned into entry points for espionage. Attackers used Teams chats and screen-sharing sessions to trick employees […]

Cybersecurity investigators have linked a deceptive ransomware-style intrusion to MuddyWater, a state-sponsored hacking group associated with Tehran’s intelligence apparatus, after forensic evidence showed the operation was built around espionage rather than financial extortion. The campaign, observed in early 2026, was presented to victims as an attack by an affiliate of the Chaos ransomware-as-a-service ecosystem. Yet the intrusion lacked a defining feature of ransomware: there was no file […]

Omani government networks have been hit by a wide-ranging espionage campaign attributed to Iran-linked operators, with evidence pointing to the theft of judicial records, identity data, staff credentials and internal system files from multiple state entities. The operation centred on the Ministry of Justice and Legal Affairs, where attackers used a custom ASP. NET webshell to maintain access, issue commands and extract data. Exposed attacker infrastructure showed […]

North Korea-linked hackers compromised a gaming platform used by ethnic Koreans in China’s Yanbian region, turning Windows and Android game software into surveillance tools aimed at users in a strategically sensitive border community. Cybersecurity researchers identified the operation as the work of ScarCruft, also tracked as APT37, Reaper and Ricochet Chollima, a long-running espionage group aligned with Pyongyang. The campaign appears to have been active since late […]

Security researchers have identified a 2005-era malware framework that appears to have targeted high-precision engineering software, raising new questions about covert attempts to disrupt Iran’s nuclear programme before Stuxnet became the defining case of cyber sabotage. The malware, tracked as Fast16, was analysed by SentinelOne researchers Vitaly Kamluk and Juan Andrés Guerrero-Saade, who found that its core components pre-date the earliest known Stuxnet operations by at least […]

Iranian authorities have arrested four people, including two foreign nationals, over the alleged import of SpaceX Starlink terminals, sharpening a crackdown on one of the few remaining channels for uncensored internet access inside the country. Iranian state-linked reporting, carried by Reuters on Sunday, said the arrests were made in the north-west and linked by officials to an alleged espionage network tied to the United States and Israel. […]

  Ukrainian municipal authorities and healthcare institutions have come under a coordinated wave of cyberattacks that security officials say was designed to steal sensitive information from web browsers and WhatsApp accounts, widening concern over espionage operations aimed at essential public services during wartime. The campaign, attributed by Ukraine’s Computer Emergency Response Team to threat cluster UAC-0247, struck local government bodies and municipal medical facilities, including clinical and […]

Hackers posing as trusted messaging and communications services have mounted a sustained surveillance campaign across the Middle East and North Africa, using fake app pages, phishing domains and a custom Android spyware known as ProSpy to target journalists, activists and political figures, according to a joint body of research published this week by Lookout, Access Now and SMEX. The operation, active since at least 2022 and documented […]

Commercial artificial intelligence tools were used as operational components in a cyber campaign that hit nine Mexican government organisations, according to a full technical report published by Gambit Security, which said the intrusion ran from late December 2025 to mid-February 2026 and exposed hundreds of millions of citizen records. The report says Anthropic’s Claude Code generated about three-quarters of the remote command activity, while OpenAI’s GPT-4.1 was […]

Sony Pictures has handed fresh momentum to its long-gestating Metal Gear Solid film, attaching directing duo Zach Lipovsky and Adam B. Stein to steer the adaptation of Konami’s espionage franchise, a move that signals the studio is trying again to bring one of gaming’s most cinematic properties to the big screen after years of stalled development. Trade reports say the project is set up at Columbia Pictures, […]

A cross-border espionage campaign that targeted journalists, civil society figures and some government-linked entities across the Middle East and North Africa between 2023 and 2024 has been tied by researchers to BITTER, a long-tracked South Asian threat actor, marking what investigators describe as the first documented case linking the group to attacks on civil society in the region. The attribution remains qualified rather than definitive: Lookout said […]

STX RAT, a newly identified remote access trojan, has drawn attention in the cyber-security sector after researchers tied it to an attempted intrusion against a financial-services environment and linked it to broader opportunistic delivery campaigns that include trojanised software and script-based loaders. The malware stands out because it combines hidden remote control with data theft, while delaying some of its most suspicious behaviour until it has an […]

U. S. authorities have dismantled the domestic arm of a cyber-espionage network that officials say was run by APT28, the Russian military intelligence hacking group also known as Fancy Bear and Forest Blizzard, after it hijacked vulnerable internet routers to redirect traffic, steal credentials and sift victims for higher-value targets. The Justice Department said the FBI used a court-authorised technical operation to identify compromised routers on U. […]

Russian military-linked hackers have hijacked vulnerable internet routers to steal passwords, authentication tokens and other sensitive data, according to a new warning from the UK’s National Cyber Security Centre, which said the activity was tied to APT28, a group long associated with Moscow’s GRU military intelligence unit 26165. British officials said the campaign worked by altering router settings so internet traffic could be redirected through malicious Domain […]

Iran-linked hackers mounted a coordinated password-spraying operation against Microsoft 365 tenants across the Middle East in March, with Israel and the United Arab Emirates emerging as the main targets in a campaign that cyber researchers say shows how regional conflict is increasingly being mirrored in the cloud. Check Point Research said the activity came in three waves on March 3, March 13 and March 23, hitting more […]

VISHNU RAJA
RYO YAMADA
HITORI GOTOH
IKUYO KITA
Just in:
Supreme Court Must Apply ‘Basic Structure’ Doctrine To Election Commission Row // PSC probe closes in on Chairman // Cong activists storm police station // IBS Proposes HK$563 Million Acquisition of AI Chip Enterprise // Oil benchmarks secure fourth consecutive monthly advance // HC invalidates Vizhinjam coastal erosion panel // UAE central bank levies Dh200 million bank penalty // Altman holds Samsung talks on AI and chips // Police book LPST protesters // Trump insults Norway over Nobel Peace Prize decision // Suspected China-linked hackers penetrate US government-affiliated network // Three ONYX Hotels Win Green Tourism Awards, Bringing “ONYX for Planet” to Life in Chonburi // CPM rules out role in Mammootty cyber attacks // Visa and Senegal formalise two-year digital payments cooperation // Britain defends investment in Rolls-Royce narrowbody engine programme // Rubin telescope identifies large dwarf planet candidate beyond Pluto // Kerala PSC chairman and members face recruitment fraud case // Chamet Strengthens Multimodal AI Moderation for Live Video Chat as Singapore’s Online Safety Commission Takes Effect // Kerala assigns DIG to examine KIIFB land dealings // Kochi police book Radisson Blu over late-night party //