Intelligence Archives - Page 2 of 174

Pierluigi Paganini August 25, 2025

Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign

APT36 uses Linux .desktop files in new attacks on Indian gov & defense, aiming for data theft and persistent espionage access. Transparent Tribe (aka APT36, Operation C-Major, and Mythic Leopard), a Pakistan-linked threat actor, is using Linux .desktop files to load malware in new attacks against government and defense entities in India. The APT group […]

Pierluigi Paganini August 25, 2025

Android.Backdoor.916.origin malware targets Russian business executives

New Android spyware Android.Backdoor.916.origin is disguised as an antivirus linked to Russia’s intelligence agency FSB, and targets business executives. Doctor Web researchers observed a multifunctional backdoor Android.Backdoor.916.origin targeting Android devices belonging to representatives of Russian businesses. The malware executes attacker commands, enabling surveillance, keylogging, and theft of chats, browser data, and even live camera/audio streams. […]

Pierluigi Paganini August 23, 2025

China-linked Silk Typhoon APT targets North America

China-linked Silk Typhoon APT group ramp up North America attacks, exploiting n-day and zero-day flaws for system access, CrowdStrike warns. China-linked Silk Typhoon APT group (aka Murky Panda) targets organizations in North America exploiting n-day and zero-day flaws for system access, CrowdStrike warns. This Chinese APT has one of the widest targeting scopes. In March, […]

Pierluigi Paganini August 22, 2025

After SharePoint attacks, Microsoft stops sharing PoC exploit code with China

Microsoft halts PoC exploit sharing with Chinese firms after SharePoint zero-day leaks, giving only written bug details to curb future abuse. Microsoft has reportedly stopped giving Chinese firms proof-of-concept exploit code through its Microsoft Active Protections Program (MAPP) program after July’s mass exploitation of SharePoint flaws, believed linked to a leak of early bug disclosures. […]

Pierluigi Paganini August 21, 2025

FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage

FBI warns FSB-linked group Static Tundra is exploiting a 7-year-old Cisco IOS/IOS XE flaw to gain persistent access for cyber espionage. The FBI warns that Russia-linked threat actor Static Tundra exploits Simple Network Management Protocol (SNMP) and end-of-life networking devices running an unpatched vulnerability (CVE-2018-0171) in Cisco Smart Install (SMI) to target organizations in the […]

Pierluigi Paganini August 16, 2025

Taiwan Web Infrastructure targeted by APT UAT-7237 with custom toolset

APT group UAT-7237, linked to UAT-5918, targets web infrastructure in Taiwan using customized open-source tools to maintain long-term access. A Chinese-speaking advanced persistent threat (APT) group, tracked as UAT-7237, has been observed targeting web infrastructure entities in Taiwan using customized versions of open-sourced tools with an aim to establish long-term access within high-value victim environments. […]

Pierluigi Paganini August 02, 2025

China Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech Tensions

China questioned Nvidia over suspected backdoors in its H20 chips, adding to rising tensions in the tech fight between the U.S. and Beijing. China’s internet watchdog has summoned Nvidia over concerns that its H20 AI chips may contain hidden backdoors. Nvidia H20 chips are AI GPUs tailored for the Chinese market, based on Hopper architecture. […]

Pierluigi Paganini August 01, 2025

ToolShell under siege: Check Point analyzes Chinese APT Storm-2603

Storm-2603 group exploits SharePoint flaws and uses a custom C2 framework, AK47 C2, with HTTP- and DNS-based variants named AK47HTTP and AK47DNS. Check Point Research is tracking a ToolShell campaign exploiting four Microsoft SharePoint flaws, linking it to China-nexus groups APT27, APT31, and a new cluster, Storm-2603. The researchers pointed out that Storm-2603’s goals remain […]

Pierluigi Paganini July 31, 2025

Russia-linked APT Secret Blizzard targets foreign embassies in Moscow with ApolloShadow malware

Russia-linked Secret Blizzard targets foreign embassies in Moscow via ISP-level AitM attacks, deploying custom ApolloShadow malware. Microsoft researchers uncovered a cyberespionage campaign by the Russia-linked APT group Secret Blizzard (aka Turla, Snake, Uroburos, Waterbug, Venomous Bear and KRYPTON) targeting foreign embassies in Moscow. The threat actor uses an adversary-in-the-middle (AiTM) method at the ISP level to deploy custom malware called ApolloShadow. This […]

Pierluigi Paganini July 28, 2025

China-linked group Fire Ant exploits VMware and F5 flaws since early 2025

China-linked group Fire Ant exploits VMware and F5 flaws to stealthily breach secure systems, reports cybersecurity firm Sygnia. China-linked cyberespionage group Fire Ant is exploiting VMware and F5 vulnerabilities to stealthily access secure, segmented systems, according to Sygnia. Since early 2025, the group has targeted virtualization and networking infrastructure, primarily VMware ESXi and vCenter environments. […]

Intelligence

Pakistan-linked APT36 abuses Linux .desktop files to drop custom malware in new campaign

Android.Backdoor.916.origin malware targets Russian business executives

China-linked Silk Typhoon APT targets North America

After SharePoint attacks, Microsoft stops sharing PoC exploit code with China

FBI: Russia-linked group Static Tundra exploit old Cisco flaw for espionage

Taiwan Web Infrastructure targeted by APT UAT-7237 with custom toolset

China Presses Nvidia Over Alleged Backdoors in H20 Chips Amid Tech Tensions

ToolShell under siege: Check Point analyzes Chinese APT Storm-2603

Russia-linked APT Secret Blizzard targets foreign embassies in Moscow with ApolloShadow malware

China-linked group Fire Ant exploits VMware and F5 flaws since early 2025

newsletter

Subscribe to my email list and stay
up-to-date!

recent articles

Stellantis probes data breach linked to third-party provider

FBI alerts public to spoofed IC3 site used in fraud schemes

EU agency ENISA says ransomware attack behind airport disruptions

Researchers expose MalTerminal, an LLM-enabled malware pioneer

Beware: GitHub repos distributing Atomic Infostealer on macOS

QUICK LINKS

Intelligence

newsletter

Subscribe to my email list and stay up-to-date!

recent articles

Subscribe to my email list and stay
up-to-date!