APT & Nation-state
APT29's Watering Holes Target Thousands of Mobile Users
After compromising websites, the Russian state-sponsored threat group is fingerprinting victims, then harvesting information from the interesting ones.
APT & Nation-state
13 stories · RSS feed for this view
APT & Nation-state
Russian state-linked hackers target iPhone, Android devices in zero-click espionage campaign
Russian state-linked hackers targeted users in Ukraine, the United States and Europe in a campaign to steal sensitive information from iPhone and Android devices, researchers found.
APT & Nation-state
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that…
APT & Nation-state
APT29-Linked Hackers Hijack Web Analytics Script to Deliver iOS and Android Exploits
The Russia-linked threat actor known as APT29 is presumed to be behind a large-scale watering hole campaign targeting iOS and Android users through compromised websites, fake domains, and a supply chain attack involving…
Ransomware
Unit 42 Threat Intelligence Highlights - Nov. 2, 2026
Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows.
APT & Nation-state
DarkBlinders Compromises Israeli Target and Iraqi Kurdish Government Cloud Environment
Cybersecurity researchers have disclosed details of a cyber espionage campaign targeting Israel and the Kurdistan Region of Iraq by an Iran state-aligned threat actor between August and October 2026. According to a…
APT & Nation-state
PapRAT Cyber-Espionage Campaign Leaves a 'Bitter' Taste in South Asia
Organizations in the region face growing cyberattacks from the known India-linked threat group, which leverages legitimate Windows functionality in three distinct attack chains.
APT & Nation-state
Government Linux Servers Targeted With SysGoRAT and Suspected AI-Generated Scripts
Cybersecurity researchers have disclosed details of a cyber espionage campaign specifically targeting Linux infrastructure associated with government entities and state-affiliated infrastructure. The activity, observed…
APT & Nation-state
As Russia's Cyberwar Evolves, Belarus Steps Forward
The "FrostyNeighbor" advanced persistent threat (APT) launched a destructive attack in Ukraine and is raising concerns about deeper alignment with Russian cyber objectives.
APT & Nation-state
Inside KeyDrift: Analyzing historical UAT-11473 activity on Cisco SD-WAN
Talos has identified UAT-11473, a highly sophisticated APT, who exploited CVE-2026-20127, an authentication bypass vulnerability in Cisco SD-WAN Catalyst Controller instances to bypass authentication and gain…
APT & Nation-state
ESET APT Activity Report Q2 2026–Q3 2026
An overview of the activities of selected APT groups investigated and analyzed by ESET Research in Q2 2026 and Q3 2026
APT & Nation-state
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
APT & Nation-state
AI-Powered Espionage Campaign Targets Government Linux Infrastructure
Our analysis an AI-powered espionage campaign targeting government Linux infrastructure with custom malware, web shells, and advanced credential theft.
