Cyble exposed a Sandworm-linked espionage campaign targeting Belarusian military UAV personnel. It uses a malicious LNK file to deploy OpenSSH over Tor obfs4 for stealthy, persistent remote access.

SEQRITE exposed SkyCloak, an espionage campaign targeting Russian/Belarusian military personnel. It uses malicious LNK files to deploy OpenSSH over Tor obfs4 bridges for stealthy, persistent remote access.

Researchers at Arctic Wolf Labs have uncovered an extensive cyber espionage campaign by UNC6384, a Chinese-affiliated threat actor, targeting European diplomatic entities across Hungary, Belgium, …

Seqrite exposed Silent Lynx APT targeting Central Asia and Russia with Operation Peek-A-Baku. The group uses LNK files and GitHub to deploy Laplas reverse shells and SilentSweeper for espionage intelligence.

JPCERT exposed APT-C-60 targeting Japan via VHDX LNK files in phishing emails. The SpyGlace malware uses GitHub to fetch encrypted commands and statcounter for victim telemetry.

ENKI exposed a Kimsuky APT campaign using a dual PE/PowerShell payload that switches based on Windows Defender status to deploy KimJongRAT. The malware steals Chrome AppBound keys via GitHub Releases C2.

Operation Hanoi Thief targets Vietnam with a pseudo-polyglot LNK/image file that executes malicious code via ftp.exe. The attack deploys LOTUSHARVEST stealer via DLL sideloading to steal Chrome/Edge credentials.

Microsoft has quietly patched a long-standing flaw in Windows that had been exploited in real-world attacks for several

SEQRITE exposed Operation DUPEHIKE targeting Russian HR with a malicious LNK bonus lure. The DUPERUNNER implant uses PowerShell and process injection into explorer.exe to deploy the Adaptix C2 Beacon.

Patchwork APT deployed StreamSpy, a new trojan that uses WebSocket for covert C2 and HTTP for file transfer, blending malicious activity with web traffic to evade detection during espionage operations.