Research reports
1,224 reports from 387 publishers45 added in the past week
166 reports, newest added first
Added Wed 28 Aug 2024
Chinese State-Sponsored RedJuliett Intensifies Taiwanese Government, Academic, and Technology Sector Cyber Espionage via Network Perimeter Exploitation
States, Rwanda, Kenya, and Djibouti. Internet-facing devices such as firewalls, load balancers, and enterprise VPNs were targeted for initial access. SQL injection and directory traversal was attempted against web and SQL applications. RedJuliett likely…
State-sponsoredVulnerabilities
Added Fri 26 Jul 2024
APT41 Has Arisen From the DUST
Written by: Mike Stokkel, Pierre Gerlings, Renato Fontana, Luis Rocha, Jared Wilson, Stephen Eckels, Jonathan Lepore Executive Summary In collaboration with Google’s Threat Analysis Group (TAG), Mandiant has observed a sustained campaign by the advanced…
State-sponsored
Arid Viper poisons Android apps with AridSpy
ESET researchers discovered Arid Viper espionage campaigns spreading trojanized apps to Android users in Egypt and Palestine Lukas Stefanko 13 Jun 2024 • 25 min. read ESET researchers have identified five campaigns targeting Android users with trojanized…
State-sponsoredMobile
New BugSleep Backdoor Deployed in Recent MuddyWater Campaigns - Check Point Research
MuddyWater, an Iranian threat group affiliated with the Ministry of Intelligence and Security (MOIS), has significantly increased its activities in Israel since the beginning of the Israel-Hamas war in October 2023. This parallels with activities against…
State-sponsoredMalwarePhishing
Added Thu 25 Jul 2024
JSAC2023_1_6_minakawa-saika-kubokawa_en.pdf
Overview 4 n Campaign using LODEINFO malware p Continuously observed for about 3 years since Dec. 2019 p Chinese state-backed APT group is behind (APT10?) n What we talk about to
State-sponsoredMalware
Added Tue 23 Jul 2024
TAG-100 Uses Open-Source Tools in Suspected Global Espionage Campaign, Compromising Two Asia-Pacific Intergovernmental Bodies
The group employs open-source remote access capabilities and exploits a wide range of internet-facing appliances for initial access, including enterprise VPN, firewall, and email appliances. TAG-100 compromised two major Asia-Pacific intergovernmental…
State-sponsored
Added Sat 20 Jul 2024
CERTFR-2024-CTI-006.pdf
ANSSI considers that the Nobelium intrusion set, also calledMidnight Blizzard 1, has been active since at least Octo-ber 2020. It is actively used against high-value targets, most likely for espionage purposes. Phishing campaigns conducted by Nobelium…
State-sponsored
Added Fri 28 Jun 2024
i-soon-data-leaks-en
On Feb. 16, 2024, someone uploaded data to GitHub that included possible internal company communications, sales-related materials and product manuals belonging to the Chinese IT security services company i-Soon, also known as Anxun Information Technology. The…
State-sponsored
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets
Pawn Storm Uses Brute Force and Stealth Against High-Value Targets | Trend Micro (US) APT & Targeted Attacks Pawn Storm Uses Brute Force and Stealth Against High-Value Targets To help defenders learn more about Pawn Storm's activities and adjust their…
State-sponsored
i-soon-data-leaks-jp
2024 年 2 月 16 日、中国の IT セキュリティ サービス会社 i-Soon (別名 Anxun Information Technology) に属する可能性のある社内通信、セールス関連資料、製品マニュアルを含むデータが何者かによって GitHub にアップロードされました。漏えいした資料は、ある営利団体が、中国とつながりのある脅威アクターを支援するサイバー スパイ ツールをどのように開発・サポートしたかを示すもののようです。漏えいデータの初期調査の一環として、Unit 42…
State-sponsored
Added Thu 27 Jun 2024
chinese-apts-target-asean-entities-en
The first APT group, Stately Taurus, created two malware packages we believe targeted entities in Myanmar, the Philippines, Japan and Singapore. The timing of these campaigns coincided with the ASEAN-Australia Special Summit, held March 4-6, 2024. The second…
State-sponsored
chinese-apts-target-asean-entities-jp
Stately Taurus (別名 Mustang Panda、BRONZE PRESIDENT、Red Delta、LuminousMoth、Earth Preta、Camaro Dragon) は少なくとも 2012 年から活動しています。私たちは同グループを「サイバースパイ活動を日常的に行っている中国の持続的標的型攻撃 (APT) グループ」と評価しています。このグループはこれまで北米やヨーロッパ、アジアの政府機関や非営利団体、宗教団体、そのほか の非政府組織を標的にしてきました。 私たちは最近、前述の…
State-sponsored
Added Wed 26 Jun 2024
(3) Kimsuky is targeting an arms manufacturer in Europe.
(3) Kimsuky is targeting an arms manufacturer in Europe. | LinkedIn Kimsuky is targeting an arms manufacturer in Europe. linkedin.com/pulse/kimsuky-targeting-arms-manufacturer-europe-dmitry-melikov-dquge Dmitry Melikov Dmitry Melikov Cyber threats researcher.…
State-sponsored
Added Tue 25 Jun 2024
SneakyChef espionage group targets government agencies with SugarGh0st and more infection techniques
Cisco Talos recently discovered an ongoing campaign from SneakyChef, a newly discovered threat actor using SugarGh0st malware, as early as August 2023. In the newly discovered campaign, we observed a wider scope of targets spread across countries in EMEA and…
State-sponsoredMalware
Flax Typhoon using legitimate software to quietly access Taiwanese organizations
Flax Typhoon using legitimate software to quietly access Taiwanese organizations | Microsoft Security Blog August 24, 2023 Flax Typhoon using legitimate software to quietly access Taiwanese organizations…
State-sponsored
Added Thu 20 Jun 2024
GRU's BlueDelta Targets Key Networks in Europe with Multi-Phase Espionage Campaigns
Azerbaijani think tank. Operational infrastructure was continuously evolved to deploy Headlace malware through three distinct phases, abusing legitimate services such as GitHub, Mocky, and InfinityFree. Credential harvesting campaigns targeted webmail service…
State-sponsored
Added Thu 16 May 2024
APT44 Report
What is Kapeka Backdoor? Countries Targeted by APT44 (Sandworm) Infection Chain Backdoor Analysis Backdoor Dropper Analysis IOCs Mitre Attack Detection Mitigation Dropper Yara Rule Technical Analysis Backdoor Yara Rule 5 6 7 8 8 12 17 18 19 19 20 21 22Uncover…
State-sponsoredMalware
Added Wed 24 Apr 2024
SVR cyber actors adapt tactics for initial cloud access
This advisory details recent tactics, techniques and procedures (TTPs) of the group commonly known as APT29, also known as Midnight Blizzard, the Dukes or Cozy Bear. The UK National Cyber Security Centre (NCSC) and international partners assess that APT29 is…
State-sponsored
PRC State-Sponsored Cyber Activity: Actions for Critical Infrastructure Leaders
SUMMARY This fact sheet provides an overview for executive leaders on the urgent risk posed by People’s Republic of China (PRC) state-sponsored cyber actors known as “Volt Typhoon.” CISA—along with the National Security Agency (NSA), the Federal Bureau of…
State-sponsored
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.