APT Archives - Page 6 of 114 - Security Affairs

Pierluigi Paganini February 27, 2025

FBI: North Korea-linked TraderTraitor is responsible for $1.5 Billion Bybit hack

The FBI confirmed that North Korea is responsible for the record-breaking cyber heist at the crypto exchange Bybit. FBI links the recent Bybit hack to North Korea-linked group TraderTraitor as details of the $1.5B cyber heist emerge. Last week, the crypto exchange Bybit suffered a sophisticated cyberattack, threat actors transferred over 400,000 ETH and stETH […]

Pierluigi Paganini February 26, 2025

New Ghostwriter campaign targets Ukrainian Government and opposition activists in Belarus

A Ghostwriter campaign using a new variant of PicassoLoader targets opposition activists in Belarus, and Ukrainian military and government organizations. SentinelLABS observed a new Ghostwriter campaign targeting Belarusian opposition activists and Ukrainian military and government entities with a new variant of PicassoLoader. The campaign has been active since late 2024, threat actors used weaponized Microsoft […]

Pierluigi Paganini February 25, 2025

EU sanctioned the leader of North Korea-linked APT groups

The European Union sanctioned the leader of North Korea-linked APT groups for aiding Russia in its war against Ukraine. The European Union announced sanctions against entities aiding Russia in the ongoing conflict with Ukraine, including Lee Chang Ho, who is the leader of North Korea-linked APT groups. Lee Chang Ho coordinated North Korean soldiers in […]

Pierluigi Paganini February 23, 2025

Lazarus APT stole $1.5B from Bybit, it is the largest cryptocurrency heist ever

Crypto exchange Bybit was the victim of a sophisticated attack, and threat actors stole $1.5B worth of cryptocurrency from one of the company’s offline wallets. Crypto exchange Bybit suffered a sophisticated cyberattack, threat actors transferred over 400,000 ETH and stETH worth more than $1.5 billion to an unidentified address. The Bybit hack is the largest cryptocurrency […]

Pierluigi Paganini February 20, 2025

Salt Typhoon used custom malware JumbledPath to spy U.S. telecom providers

China-linked cyber espionage group Salt Typhoon uses custom malware JumbledPath to on spy U.S. telecom providers. Cisco Talos researchers reported that China-linked APT group Salt Typhoon uses a custom-built utility, dubbed JumbledPath, to spy on network traffic of U.S. telecommunication providers. China-linked APT group Salt Typhoon (also known as FamousSparrow and GhostEmperor) and has been active since at least 2019 and […]

Pierluigi Paganini February 19, 2025

Russia-linked APTs target Signal messenger

Russia-linked threat actors exploit Signal ‘s “linked devices” feature to hijack accounts, per Google Threat Intelligence Group. Google Threat Intelligence Group (GTIG) researchers warn of multiple Russia-linked threat actors targeting Signal Messenger accounts used by individuals of interest to Russian intelligence. The experts speculate that the tactics, techniques, and procedures used to target Signal will […]

Pierluigi Paganini February 18, 2025

China-linked APT group Winnti targets Japanese organizations since March 2024

China-linked threat actor Winnti targeted Japanese companies in the manufacturing, materials, and energy sectors in March 2024 as part of a campaign dubbed RevivalStone. Researchers from cybersecurity firm LAC uncovered a new cyberespionage campaign, tracked as RevivalStone, carried out by the China-linked APT group Winnti in March 2024. Threat actors targeted Japanese companies in the manufacturing, […]

Pierluigi Paganini February 16, 2025

Storm-2372 used the device code phishing technique since August 2024

Russia-linked group Storm-2372 used the device code phishing technique since Aug 2024 to steal login tokens from governments, NGOs, and industries. Microsoft Threat Intelligence researchers warn that threat actor Storm-2372, likely linked to Russia, has been targeting governments, NGOs, and various industries across multiple regions since August 2024. The attackers employ a phishing technique called […]

Pierluigi Paganini February 14, 2025

China-linked APT Salt Typhoon breached telecoms by exploiting Cisco router flaws

China-linked APT Salt Typhoon has breached more U.S. telecommunications providers via unpatched Cisco IOS XE network devices. China-linked APT group Salt Typhoon is still targeting telecommunications providers worldwide, and according to a new report published by Recorded Future’s Insikt Group, the threat actors has breached more U.S. telecommunications providers by exploiting unpatched Cisco IOS XE […]

Pierluigi Paganini February 13, 2025

China-linked APTs’ tool employed in RA World Ransomware attack

A November 2024 RA World ransomware attack on an Asian software firm used a tool linked to China-linked threat actors. Broadcom researchers reported that threat actors behind an RA World ransomware attack against an Asian software and services firm employed a tool that was explosively associated in the past with China-linked APT groups. “Tools that […]

APT

FBI: North Korea-linked TraderTraitor is responsible for $1.5 Billion Bybit hack

New Ghostwriter campaign targets Ukrainian Government and opposition activists in Belarus

EU sanctioned the leader of North Korea-linked APT groups

Lazarus APT stole $1.5B from Bybit, it is the largest cryptocurrency heist ever

Salt Typhoon used custom malware JumbledPath to spy U.S. telecom providers

Russia-linked APTs target Signal messenger

China-linked APT group Winnti targets Japanese organizations since March 2024

Storm-2372 used the device code phishing technique since August 2024

China-linked APT Salt Typhoon breached telecoms by exploiting Cisco router flaws

China-linked APTs’ tool employed in RA World Ransomware attack

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

Seychelles Commercial Bank Reported Cybersecurity Incident

Microsoft uncovers macOS flaw allowing bypass TCC protections and exposing sensitive data

U.S. CISA adds Cisco ISE and PaperCut NG/MF flaws to its Known Exploited Vulnerabilities catalog

Critical WordPress Post SMTP plugin flaw exposes 200K+ sites to full takeover

Scattered Spider targets VMware ESXi in using social engineering

QUICK LINKS

APT

newsletter

Subscribe to my email list and stay up-to-date!

recent articles

Subscribe to my email list and stay
up-to-date!