Foreign Affairs

A backdoor code window with emoji-marked comments, three target pins on Brazil, Germany, South Korea.

Threat Intelligence

Kimsuky's PebbleDash Now Hits Defense Sectors in Three Countries — And Its New Backdoor Was Coded With AI

Kaspersky found something unusual in a North Korean backdoor: comments that look written by an LLM, not a human. Combined with Kimsuky's expansion into defense targets across three countries, it is documented evidence that state malware development is borrowing AI.

A laptop with a Signal message database file being siphoned out, a backdoor injected into a system process.

Threat Intelligence

Microsoft's Kazuar Analysis Shows Russia's Secret Blizzard Wants Your Signal Desktop Files

Microsoft's new Kazuar analysis names one capability that ties it to the other Russian Signal operation in the news: Kazuar steals Signal Desktop message files. Encryption protects the conversation in transit — not the database on a compromised laptop.

A PDF document splitting into two paths over a map of Ukraine — one benign, one malicious RAR archive.

Cyber Attacks

Ghostwriter Now Geofences Its Phishing Lures — Only Ukrainian IPs Get the Malware

Ghostwriter built operational security into its phishing lure. Send the campaign's malicious PDF to a Ukrainian IP and it triggers the attack chain. Send it anywhere else — including to the analysts investigating it — and they get a harmless document.

Oil derrick and pipeline overlaid on a map of the Caspian region, three intrusion-wave arrows.

Threat Intelligence

Salt Typhoon Just Pivoted to Azerbaijani Oil and Gas — Chinese APT Targeting Now Follows Energy Geopolitics

Salt Typhoon spent three months inside an Azerbaijani oil and gas company — a target type it normally ignores. Bitdefender's assessment of why is the part that matters: Chinese APT targeting now follows energy geopolitics in real time.

Smartphone with a fake support chat bubble, a snowballing chain of contact nodes expanding outward.

Cyber Attacks

A Spyware Investigator Turned a Signal Hijack Attempt Into a 13,500-Target Russian Campaign Map

Russian government hackers tried to hijack the Signal account of the wrong person. Donncha Ó Cearbhaill investigates spyware for a living — so he reverse-engineered the campaign and found himself one of 13,500+ targets. The 'snowball' methodology is the lesson.

Server with neural-net glow, government silhouette, globe with tension lines.

AI Security

Germany Warns China Is Close to an AI 'Superhacker' — and Building It in Secret

Germany's top cybersecurity official told lawmakers that China is close to building an AI model with superhacking capabilities — developed in secret. The warning lands a month after Anthropic gated Mythos. AI cyber capability is now great-power competition.

Masked operative removing a ransomware mask, Teams chat window, credentials text file.

Cyber Attacks

Iranian Spies Are Pretending to Be Ransomware Operators — Inside MuddyWater's Chaos False Flag

An Iranian state-sponsored APT spent early 2026 conducting espionage while wearing the Chaos ransomware brand as a costume. Rapid7 pulled back the curtain. The Microsoft Teams screen-sharing tradecraft is why IR triage needs updating.

A wifi router with a 2029 calendar above it, a hovering drone, dashed signal lines. Red dot as the router status light.

Policy & Government

FCC Backs Off Foreign Router Ban — Updates Now Extended to 2029

The FCC extended the security update cutoff for foreign-made routers and drones from March 2027 to January 2029. The import ban on the Covered List remains. Netgear and Eero hold conditional approval through October 2027.

Topographic map with contour lines folding into a paper airplane at one corner, a quadcopter drone hovering above, a download arrow descending to a hard drive.

Threat Intelligence

HeartlessSoul Wants Map Data. Russian Aerospace and Drone Operators Are Giving It to Them.

Kaspersky disclosed cyber espionage group HeartlessSoul on May 11, targeting Russian aerospace firms and drone operators through SourceForge malvertising to steal GIS shape files, GPS data, and terrain models. The operational ground truth Russian analysts use is the prize.

Two server racks linked by a shared cable through a central hexagonal node, with a bracket-handshake symbol above and a red-orange accent dot.

Threat Intelligence

Two Pro-Ukraine Hacktivist Groups Are Now Sharing Infrastructure — and It Looks Quasi-State-Sponsored

Kaspersky researchers reported on May 7-8 that pro-Ukraine hacktivist groups BO Team (also known as Black Owl) and Head Mare appear to be coordinating their cyber operations against Russian organizations — sharing infrastructure including command-and-control systems on the same compromised host. BO Team had previously operated more autonomously than other hacktivist

See all

Kimsuky's PebbleDash Now Hits Defense Sectors in Three Countries — And Its New Backdoor Was Coded With AI

Microsoft's Kazuar Analysis Shows Russia's Secret Blizzard Wants Your Signal Desktop Files

Ghostwriter Now Geofences Its Phishing Lures — Only Ukrainian IPs Get the Malware

Salt Typhoon Just Pivoted to Azerbaijani Oil and Gas — Chinese APT Targeting Now Follows Energy Geopolitics

A Spyware Investigator Turned a Signal Hijack Attempt Into a 13,500-Target Russian Campaign Map

Germany Warns China Is Close to an AI 'Superhacker' — and Building It in Secret

Iranian Spies Are Pretending to Be Ransomware Operators — Inside MuddyWater's Chaos False Flag

FCC Backs Off Foreign Router Ban — Updates Now Extended to 2029

HeartlessSoul Wants Map Data. Russian Aerospace and Drone Operators Are Giving It to Them.

CISA Tells Critical Infrastructure Operators to Plan for Weeks of Cyber Isolation

Two Pro-Ukraine Hacktivist Groups Are Now Sharing Infrastructure — and It Looks Quasi-State-Sponsored

A 404 Media Reporter Watched Someone Else Become Him, Live, on Microsoft Teams