China-Linked Hackers Chain Chrome and Windows Zero-Days to Breach NGOs
China-linked UTA0560 and APT31 chained Chrome and Windows zero-days via spear-phishing to breach NGOs, deploying GRIMWEDGE and credential-stealing malware.
APT
More news
Page 4 / 9 · 79 articles
Sandworm-Linked Operators Chain Cisco FMC Flaws to Deploy New Cyclops Blink
Russian-linked actors exploit CVE-2026-20079 and CVE-2026-20316 in Cisco FMC to deploy redesigned Cyclops Blink backdoor for persistence and espionage.
Red Heron Exploits Critical Gitea RCE to Breach 13 Organizations
China-linked Red Heron exploited CVE-2026-60004 Gitea RCE to breach 13 orgs, steal repos, harvest credentials and gain root access to internal networks.
NSA Plans Five Mission Centers in Rapid Agency-Wide Reorganization
NSA to replace directorates with five mission centers on China, cybersecurity, AI, combat support and global intelligence by January.
UNC3569 Exploited Sogou Input Method to Install GRAYRABBIT Backdoor
UNC3569 exploited Sogou Input Method's sgbiz protocol and outdated Chromium browser to execute code and deploy GRAYRABBIT backdoor via DLL sideloading.
BlueMoon Exploit Kit Gives Four Espionage Groups a Shared Chrome-to-Windows Attack Chain
Four espionage groups use BlueMoon exploit kit chaining Chrome V8 flaws and Windows ALPC bug to escape sandbox and deploy payloads.
Trojanized HAProxy in South Korea: the ted backdoor intercepts traffic and conceals remote control
Rapid7 found trojanized HAProxy 2.8.12 in South Korea deploying the ted backdoor to hijack traffic, hide C2, execute commands and steal credentials.
Bauman: Leaked Documents Expose the University Pipeline for GRU Cyber Operators
Over 2,000 leaked Bauman University files expose Department No. 4 training GRU cyber operators linked to APT28 and Sandworm operations.
Fake Recruiters Deploy NodeRabbit and PollCat: Nimbus Manticore’s New Cross-Platform RATs
Iran's Nimbus Manticore lures developers with fake LinkedIn coding tests to deploy NodeRabbit and PollCat RATs for cross-platform espionage.