Acronis reveals Khmer Shadow, a new espionage campaign using NIGHTFORGE loader and DLL sideloading to target Cambodian government entities with Havoc Demon.

Cyberattacks against critical infrastructure increasingly resemble strategic positioning rather than isolated breaches. Consequently, threat actors prepare for future disruptions. The Australian S…

TL;DR A Debian maintainer flagged a widespread OpenSSL error handling problem across the open-source ecosystem. It surfaced when apt failed HTTPS repository access on FIPS-only systems, then trace…

At a Glance Actor or group: Armored Likho APT (suspected) Activity type: Spear-phishing and information theft Targets or victims: Government agencies and the electric power sector Scale: Global op…

At a Glance Actor or group: Cavern Manticore APT (suspected Iran-linked) Activity type: Cyber-espionage and network infiltration Targets or victims: Israeli government and IT sectors Scale: Multip…

Threat intel flagged an APT group, IronShade, actively targeting Linux servers across the region. Instead of waiting to become a victim…

At a glance Actor / group APT-C-60 (threat group) Activity Spear-phishing, LNK loader, SpyGlace backdoor Targets / victims Organizations in Japan Scale Ongoing campaign; victim count not disclosed…

TL;DR Canonical shipped fixes for CVE-2026-11386 in USN-8555-1 on July 16, 2026. This Ubuntu Pro Client vulnerability scores CVSS 9.0 and can end in arbitrary code execution with root privileges. …

Unveiling the HollowGraph Threat A cloud calendar can conceal far more than mundane appointments; the HollowGraph malware exploits Microsoft 365 to clandestinely receive commands and transmit pilf…

At a glance Actor / group Suspected Chinese-speaking APT group (low confidence) Activity type Cyberespionage using malicious ViPNet update modules Targets / victims Large Russian government, energ…

At a glance Actor / group DoNot (APT-C-35); assessed by multiple vendors as India-aligned Activity type Targeted cyber-espionage via spear-phishing and RTF template injection Targets / victims Ban…

An Unprotected Directory Exposes Espionage Operations A single overlooked server misconfiguration inadvertently exposed the inner workings of an entire China-nexus cyber espionage infrastructure. …

Google is introducing a unified naming system for the hacker groups its specialists track. Instead of labels like APT1 and a jumble of unrelated identifiers, attackers will now receive memorable t…

An ordinary email attachment can serve as the perilous gateway to a sophisticated attack chain when a meticulously crafted toolkit lurks behind a seemingly benign document. Recently, analysts at 3…

At a glance Actor Mirage Kitten (also UNC1549, Smoke Sandstorm, Nimbus Manticore) Activity State-aligned cyber espionage and long-term network access Targets Aviation, defense, telecom, government…

The Chinese threat group Jewelbug has repurposed a single piece of infrastructure to serve two distinct objectives simultaneously: surveilling government organizations and profiting from cryptocur…

At a glance Actor/group Head Mare (tracked by Kaspersky; reclassified from hacktivist group to APT) Activity type Exploitation of unpatched TrueConf server flaws to distribute a trojanized client …

At a Glance Actor or group: NightEagle (also tracked as APT-Q-95). Activity type: Cyberespionage, tunneling, and Active Directory compromise. Targets or victims: Businesses in Russia (previously f…

At a glance Actor UAT-11985 (tracked by Cisco Talos) Activity Spear-phishing, QR code phishing (quishing), and AitM credential theft Targets People affiliated with Taiwan research organizations Sc…

After a three-month lull, Prince of Persia hid a Tornado C&C server on US shared hosting, its first US-based server since 2016.