Nation-State Cyber Threats
Three senior European intelligence officials told The Associated Press that Russian services are building fake companies, recruiting middlemen, and deploying cyber spies to take Western technology — and treating the cyber and human lines as one operation.
Nation-State Cyber Threats
ENKI says Kimsuky ran a March-April 2026 wave against South Korean military and corporate targets, delivering an HTTPSpy variant through a fake Webex meeting page wired to a real scheduled event and a new infection-verification technique it calls JSONPing.
Nation-State Cyber Threats
WithSecure has tied a likely-Russian threat cluster named GreyVibe to a Ukraine-focused campaign that uses ChatGPT, Gemini and Ideogram AI as productivity tooling across lures, malware and post-compromise operations.
Nation-State Cyber Threats
ESET's October 2025 - March 2026 APT report names two findings defenders cannot ignore: a Polish energy company hit in December 2025 by a new wiper, DynoWiper, attributed to Sandworm with medium confidence, and the npm package axios compromised by attackers ESET ties to Lazarus.
Nation-State Cyber Threats
Israeli firm Gambit Security says the 'Ababil of Minab' hacktivist persona that claimed the March 2026 LA Metro breach is, on its forensic evidence, a front for Iran's Ministry of Intelligence and Security. At least 700 GB was stolen, and attackers reached a rail-yard control display.
Nation-State Cyber Threats
Nimbus Manticore — the Iran-nexus APT The CyberSignal covered as Screening Serpens — has returned with a new backdoor codenamed MiniFast that Check Point Research assesses was developed with AI assistance, and a target set that now spans aviation, aerospace, defense, software, and telecom.
Data Breaches
Lithuania's Prosecutor General's Office says more than 600,000 records were pulled from the Centre of Registers using valid Migration Department login credentials issued queries from abroad. The registry itself was not breached — an authorized third party's login was.
Nation-State Cyber Threats
Fox-IT disclosed RemotePE, a RAT the North Korea-linked Lazarus Group runs entirely in memory and never writes to disk. It is the final stage of a multi-stage chain, deployed only after the noisier RATs are deliberately cleaned up.
Nation-State Cyber Threats
Palo Alto Networks' Unit 42 is tracking Screening Serpens, an Iran-nexus APT that fuses DLL sideloading with AppDomainManager hijacking to make .NET applications switch off their own security mechanisms, then deploys six new RATs across the U.S., Israel, and the UAE.
Nation-State Cyber Threats
Lumen's Black Lotus Labs disclosed Showboat, a modular Linux backdoor a China-affiliated espionage operation has used to sit inside Middle East and Central Asia telecom networks for roughly four years. A SOCKS5-proxy foothold inside a carrier is a persistent window into a region's traffic.
Nation-State Cyber Threats
ESET documented Webworm, a China-aligned APT that pivoted from Asia to European governments. Its two new backdoors — EchoCreep and GraphWorm — run command-and-control entirely on Discord and Microsoft OneDrive, hiding inside the trusted cloud traffic every enterprise allowlists.
Nation-State Cyber Threats
Symantec independently confirmed Fast16, a 2005-era pre-Stuxnet sabotage framework first disclosed by SentinelOne. It silently corrupted LS-DYNA and AUTODYN finite-element solver outputs for nuclear weapons design, acting only when material density crossed 30 g/cm cubed.