Group-IB reports on MuddyWater, an Iranian APT, shifting tactics from RMM tools to custom malware and spearphishing, using new backdoors like Phoenix.

A Chinese APT, RedNovember, is using backdoors like Pantegana and SparkRAT to expand its global espionage, targeting U.S. defense, aerospace, and tech firms.

Sigma Rule-Based Detection Framework with Low False Positive Optimization

Executive summary

An iOS exploit developer was shocked to receive an Apple warning after being targeted by the same kind of state-sponsored mercenary spyware he researches.

China's CNCERT claims the US NSA conducted a two-year cyber operation using 42 tools to steal data and infiltrate the National Time and Frequency Center.

Hackers, possibly state-linked, infiltrated Ribbon Communications for 9 months, accessing client files. The telecom supplier (Verizon, DoD clients) has notified victims.

A Critical RCE (CVSS 10.0) flaw, React2Shell, in React/Next.js's Flight protocol allows unauthenticated system takeover. North Korean and Chinese state actors are actively exploiting the deserialization bug.

Apple patched two critical zero-days in WebKit (UAF & Memory Corruption) under active exploitation in extremely sophisticated attacks against targeted individuals. Update iOS 26 immediately.

The United Kingdom has announced sanctions against two Chinese technology companies, accusing them of reckless and indiscriminate cyberattacks