Topic
Covert state-sponsored or state-linked hacking aimed at stealing data, intellectual property, or maintaining long-term access inside targeted organizations.
North Korea's Kimsuky targeted Ukrainian diplomacy and security experts with fake conference invitations, Genians reported Monday. Most observed attempts failed, and Genians' researchers say the aim may be intelligence on the war.
Reality
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
Acronis says a new backdoor pair is hitting Afghan telecom and South Asian critical infrastructure, with one implant running command and control through the Google Sheets API.
Reality
Bitdefender says a China-nexus cluster hit Central Asian governments with seven RAT families, five undocumented. The AI fingerprint is in the workflow, not the code.
Reality
Hunt.io only found the intrusion because the operator left his staging directory browsable on port 8000 in Amsterdam. The scripts inside needed no passwords, just valid usernames and an ownCloud install nobody had updated.
Perspective Coverage
3 publishersReality
ESET traced more than a year of espionage against government organizations in eight Latin American countries and territories to a modular C++ implant that hooks CreateThread so every thread it spawns looks like AnimateWindow.
Perspective Coverage
5 publishersReality
Securonix pulled four scheduled tasks and a Startup folder copy out of one infected machine, and the two PowerShell modules restart each other. Delete the desktop script and the backdoor keeps collecting documents.
Perspective Coverage
3 publishersReality
Zscaler ThreatLabz says the Pakistan-aligned group worked government and defense targets in India and Afghanistan with four undocumented tools, one of them a Rust backdoor that takes its orders from files in a private repo.
Reality
Krebs On Security watched the database grow by nearly 400,000 records in one day, matching Nexus's own claim of more than a year of continuous exfiltration from an identity verification company.
Reality
German firms' own attribution of attacks to state services has moved from 7% to nearly 40% in two years. That puts nation-state tradecraft on the risk register of any mid-sized manufacturer with a supplier list.
Reality