Nation-State Cyber Threats

Flat white line-art of a robot at an open terminal beside a government building, on a teal background — Hermes AI agent in the Thai Finance Ministry case.

Artificial Intelligence (AI)

Hermes Autonomous Agent in "YOLO Mode" Named in Thai Ministry of Finance Espionage

Now with a name and a mode — the Thai Finance Ministry attribution lands this week.

Flat white line-art of an open back door linked by one line to a distant relay node, on a teal background — the NightLedger backdoor.

Nation-State Cyber Threats

Iran-Linked Nimbus Manticore Deploys NightLedger Backdoor Across Middle East, Africa, South Asia

New backdoor, familiar actor — the Iran-linked group tracked as Nimbus Manticore has a fresh toolset, and Kaspersky's write-up of NightLedger lands this week.

Flat white line-art of an autonomous agent working a console alone beside a government finance building, on a teal background — AI-agent espionage.

Artificial Intelligence (AI)

Hackers Used Autonomous AI Agent to Target Thailand Finance Ministry, Researchers Say

Ten days after Hugging Face — the second autonomous-agent cyber event lands this week.

Flat white line-art of a large envelope linked to a shield and a webmail window, on a cobalt-blue background — the NCSC-led Russian Zimbra zero-click alert.

Nation-State Cyber Threats

UK NCSC and Partners Publish International Alert on Russian State-Supported Zero-Click Zimbra Zero-Day Campaign

A year-long Russian state-supported zero-click Zimbra campaign, exposed this week by NCSC UK and partners across some 16 nations — a defender review for any organization still running unpatched Zimbra.

Editorial illustration of a diplomatic training portal with a long shadow and a lifted file, marking South Korea's nine-month diplomatic-academy breach.

Data Breaches

South Korea's Foreign Ministry Confirms Nine-Month Breach of Diplomatic Training System

A nine-month South Korean foreign-ministry breach — allied foreign-ministry defender posture review this week.

Editorial illustration of an IP security camera turned toward supply trucks, marking the AIVD/MIVD warning on Russian camera-hijacking across NATO and Ukraine.

Nation-State Cyber Threats

AIVD and MIVD Warn Russian Intelligence Hijacks IP Cameras Across NATO States and Ukraine to Track Military Logistics

A Dutch intelligence advisory raises the stakes on Russian camera-hijacking activity — critical-infrastructure defender teams review IP-camera posture this week.

Editorial illustration of a fake CAPTCHA checkbox tagged with a state emblem over a map of Ukraine, marking CERT-UA naming Sandworm subgroup UAC-0145.

Nation-State Cyber Threats

CERT-UA Names Sandworm Subgroup UAC-0145 Behind ClickFix CAPTCHA Campaign Against Ukrainian Devices

CERT-UA names UAC-0145 as the Sandworm sub-cluster behind the ClickFix CAPTCHA activity against Ukrainian devices - a GRU-affiliated crew, and defender awareness for Ukraine-adjacent teams this weekend.

Editorial illustration of a signing seal lifted from a certificate vault, marking Expel's attribution of the DigiCert breach to the CylindricalCanine subgroup.

Supply Chain Attack

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

A code-signing-integrity attribution against a Chinese cybercrime subgroup — and a prompt for supply-chain defenders to review how much trust their pipelines place in a valid signature.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a state-emblem shield adopting a fake fix-it prompt, marking Ars Technica's report of Russia's Sandworm cluster using ClickFix.

Nation-State Cyber Threats

Ars Technica Reports Russia's Sandworm Cluster Now Using ClickFix Technique

ClickFix migrates from financially motivated crime to nation-state activity, according to Ars Technica's report on Russia's Sandworm cluster - a defender-awareness read for this week.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

Editorial illustration of a dormant kernel gear reawakening beside a small hidden door, marking Daxin's resurfacing in Taiwan with the new Stupig backdoor.

Nation-State Cyber Threats

Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor

A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.

See all