Explore the capabilities of Earth Alux, an APT group using intricate tools for cyber-espionage in strategic sectors globally.

Trend Micro uncovers BPFDoor backdoor used in cyberespionage across Asia and the Middle East, attributing it to the Red Menshen APT group

Threat actors abuse Microsoft’s mavinject.exe to inject malicious DLLs into trusted processes, evading detection in stealthy APT campaigns.

Earth Kurma APT campaign targets Southeast Asian governments and telecoms using rootkits, loaders, and cloud services to steal sensitive data.

Earth Kasha targets Taiwan and Japan in a March 2025 spear-phishing campaign using ANEL and NOOPDOOR backdoors for stealthy cyber espionage.

GEOINT, or Geospatial Intelligence, is a part of OSINT (Open-Source Intelligence) that focuses on information related to locations, maps…

Earth Ammit’s VENOM and TIDRONE campaigns target Taiwan and South Korea’s drone, military, and satellite sectors via stealthy supply chain attacks.

Earth Lamia, a China-linked APT, is targeting critical industries worldwide using SQL injection, CVEs, and custom backdoors like PULSEPACK.

Seqrite Labs uncovers Operation DRAGONCLONE, a sophisticated APT campaign targeting China Mobile Tietong with VELETRIX and VShell malware.

GeoServer's RCE flaw (CVE-2024-36401) is actively exploited to deploy NetCat reverse shells and XMRig CoinMiners on Windows/Linux, hijacking resources.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Google launches AlphaEarth Foundations, an AI model that functions as a "virtual satellite," integrating vast data to monitor and analyze changes across Earth with unprecedented speed and detail.

A group of state-sponsored (APT) actors, known as Salt Typhoon, remains a significant threat to networks across the globe, reveals the latest report from cybersecurity research firm Darktrace.

Trend exposed "Premier Pass-as-a-Service," a model where Earth Estries (access broker) and Earth Naga (APT36) share compromised network access to deploy ShadowPad in a coordinated espionage campaign.

Introduction

Amazon exposed Chinese APTs exploiting the React2Shell zero-day (CVE-2025-55182, CVSS 10.0) hours after disclosure. Earth Lamia and Jackpot Panda are actively targeting unpatched Next.js servers for reconnaissance.

Two China-linked hacking groups began exploiting a critical vulnerability in React Server Components just hours after it became

Researchers at Check Point Research have uncovered a large-scale espionage operation conducted by the Chinese APT group Ink

Ink Dragon is weaponizing government servers in Europe using a relay-centric mesh. By hijacking IIS servers, they mask C2 traffic across global networks.

Darktrace dissects SnappyBee (Deed RAT), a stealthy Salt Typhoon backdoor. Learn how it uses DLL side-loading & memory hooking to evade modern AV.