Nation-State Cyber Threats

Editorial illustration of a signing seal lifted from a certificate vault, marking Expel's attribution of the DigiCert breach to the CylindricalCanine subgroup.

Supply Chain Attack

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

A code-signing-integrity attribution against a Chinese cybercrime subgroup — and a prompt for supply-chain defenders to review how much trust their pipelines place in a valid signature.

Editorial illustration of a coiled serpent slipping into a government building's document tray, marking Kaspersky's GoSerpent espionage malware in Southeast Asia.

Nation-State Cyber Threats

Kaspersky Documents "GoSerpent" Malware Targeting Southeast Asian Governments and Diplomats

Another Southeast-Asia-focused espionage cluster documented by Kaspersky — a defender research review this week for government and diplomatic entities in the region.

Editorial illustration of a state-emblem shield adopting a fake fix-it prompt, marking Ars Technica's report of Russia's Sandworm cluster using ClickFix.

Nation-State Cyber Threats

Ars Technica Reports Russia's Sandworm Cluster Now Using ClickFix Technique

ClickFix migrates from financially motivated crime to nation-state activity, according to Ars Technica's report on Russia's Sandworm cluster - a defender-awareness read for this week.

Editorial illustration of an SVG flag image concealing a hidden payload behind a coding-test window — North Korea Contagious Interview OtterCookie campaign.

Nation-State Cyber Threats

Researchers Document North Korea-Linked "Contagious Interview" Campaign Using SVG Steganography to Deliver OtterCookie-Aligned Malware

Another Contagious Interview variant with a novel SVG delivery angle — a defender-oriented research review of how North Korea-linked actors hid an OtterCookie-aligned payload inside flag images sent through fake coding challenges.

Editorial illustration of a dormant kernel gear reawakening beside a small hidden door, marking Daxin's resurfacing in Taiwan with the new Stupig backdoor.

Nation-State Cyber Threats

Symantec: Daxin Kernel Rootkit Resurfaces in Taiwan Alongside New "Stupig" Backdoor

A dormant China-linked kernel rootkit surfaces again in Taiwan with a new backdoor companion — defender research review this week.

Editorial illustration of a fake CAPTCHA checkbox wired to a command prompt, marking CERT-UA's Sandworm PowerShell-paste technique aimed at Ukrainian users.

Nation-State Cyber Threats

Ukraine and CERT-UA Document Sandworm CAPTCHA-PowerShell Trick Targeting Ukrainian Users

Another Sandworm-attributed technique lands from CERT-UA — end-user awareness and defender posture review this week for Ukraine-adjacent organizations.

Editorial illustration of an open national risk register with a hazard-warning triangle rising from the page, marking the UK's catastrophic cyber-attack warnings.

Policy & Government

UK Government Updates National Risk Register with Catastrophic Cyber-Attack Warnings

The UK Government adds catastrophic cyber warnings to its National Risk Register — UK-operating defenders align posture this week.

Editorial illustration of a map pin formed from a signal wave over a military dog-tag, marking reported Iranian mobile-network tracking of US forces.

Nation-State Cyber Threats

Iran Abused Mobile-Network Vulnerabilities to Locate US Military Personnel, TechCrunch Reports

A nation-state mobile-network-vulnerability disclosure with defense-sector implications — coverage this week.

Editorial illustration of a magnifying glass revealing a fingerprint on a power pylon, marking EU and UK attribution of Poland's grid attack to Russia's Turla.

Nation-State Cyber Threats

EU and UK Formally Attribute Poland Power-Grid Cyberattack to Russia's Turla

A formal EU/UK attribution against Russia's Turla for a Polish power-grid attack — critical-infrastructure defender posture stays elevated this week.

Editorial illustration of a network router beneath a multi-seal advisory notice, marking a joint US, UK and allied warning on Russian router targeting.

Nation-State Cyber Threats

US, UK and Allies Warn Russian State-Linked Actors Are Targeting Critical-Infrastructure Routers

A multilateral cybersecurity advisory on Russian router-targeting activity lands on critical-infrastructure defender teams' desks — the guidance reissues warnings the same agencies have made before, and asks operators to review posture this week.

Flat white line-art of two pennant flags converging, with one flat red dot.

Nation-State Cyber Threats

SentinelOne Details Suspected China- and India-Aligned Espionage Against Pakistan's Balochistan Police

A dual-attribution espionage disclosure targeting one Pakistani police force — a rare cross-nation-state analytical beat.

Flat white line-art of a shield beside a monitoring screen — Microsoft research on the GigaWiper espionage-and-destructive malware family.

Threat Intelligence

Microsoft Details "GigaWiper," a Malware Family Combining Espionage and Destructive Capabilities

A new destructive-plus-espionage malware family lands on defenders' desks — detection-engineering review this week.

See all