Latest APT news

Hacking group used ProxyLogon exploits to breach hotels worldwide

A newly discovered cyberespionage group has been targeting hotels worldwide around the world since at least 2019, as well as higher-profile targets such as governments, international organizations, law firms, and engineering companies.
- Sergiu Gatlan
- September 23, 2021
- 03:50 PM
- 0
Russian state hackers use new TinyTurla malware as secondary backdoor

Russian state-sponsored hackers known as the Turla APT group have been using new malware over the past year that acted as a secondary persistence method on compromised systems in the U.S., Germany, and Afghanistan.
- Ionut Ilascu
- September 21, 2021
- 11:54 AM
- 0
FBI and CISA warn of state hackers exploiting critical Zoho bug

The FBI, CISA, and the Coast Guard Cyber Command (CGCYBER) today warned that state-backed advanced persistent threat (APT) groups are actively exploiting a critical flaw in a Zoho single sign-on and password management solution since early August 2021.
- Sergiu Gatlan
- September 16, 2021
- 02:11 PM
- 0
Govt hackers impersonate HR employees to hit Israeli targets

Hackers associated with the Iranian government have focused attack efforts on IT and communication companies in Israel, likely in an attempt to pivot to their real targets.
- Ionut Ilascu
- August 17, 2021
- 05:31 PM
- 0
US indicts members of Chinese-backed hacking group APT40

Today, the US Department of Justice (DOJ) indicted four members of the Chinese state-sponsored hacking group known as APT40 for hacking various companies, universities, and government entities in the US and worldwide between 2011 and 2018.
- Sergiu Gatlan
- July 19, 2021
- 10:44 AM
- 0
Chinese cyberspies’ wide-scale APT campaign hits Asian govt entities

Kaspersky researchers have revealed an ongoing and large-scale advanced persistent threat (APT) campaign with hundreds of victims from Southeast Asia, including Myanmar and the Philippines government entities.
- Sergiu Gatlan
- July 14, 2021
- 08:33 AM
- 0
Chinese cyberspies are targeting US, EU orgs with new malware

Chinese threat groups continue to deploy new malware strains on the compromised network of dozens of US and EU organizations after exploiting vulnerable Pulse Secure VPN appliances.
- Sergiu Gatlan
- May 28, 2021
- 12:12 PM
- 0
Microsoft: Russian SVR hackers target govt agencies from 24 countries

The Microsoft Threat Intelligence Center (MSTIC) has discovered that the Russian-backed hackers behind the SolarWinds supply-chain attack are now coordinating an ongoing phishing campaign targeting government agencies worldwide.
- Sergiu Gatlan
- May 28, 2021
- 08:08 AM
- 0
FBI: APT hackers breached US local govt by exploiting Fortinet bugs

The Federal Bureau of Investigation (FBI) says the webserver of a US municipal government was breached by state-sponsored attackers after hacking a Fortinet appliance.
- Sergiu Gatlan
- May 27, 2021
- 02:00 PM
- 0
Russian state hackers switch targets after US joint advisories

Russian Foreign Intelligence Service (SVR) operators have switched their attacks to target new vulnerabilities in reaction to US govt advisories published last month with info on SVR tactics, tools, techniques, and capabilities used in ongoing attacks.
- Sergiu Gatlan
- May 07, 2021
- 11:29 AM
- 0
US warns of Russian state hackers still targeting US, foreign orgs

The FBI, the US Department of Homeland Security (DHS), and the Cybersecurity and Infrastructure Security Agency (CISA) warned today of continued attacks coordinated by the Russian-backed APT 29 hacking group against US and foreign organizations.
- Sergiu Gatlan
- April 26, 2021
- 11:16 AM
- 0
North Korean hackers use new Vyveva malware to attack freighters

The North Korean-backed Lazarus hacking group used new malware with backdoor capabilities dubbed Vyveva by ESET researchers in targeted attacks against a South African freight logistics company.
- Sergiu Gatlan
- April 08, 2021
- 09:01 AM
- 0
FBI and CISA warn of state hackers attacking Fortinet FortiOS servers

The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) warn of advanced persistent threat (APT) actors targeting Fortinet FortiOS servers using multiple exploits.
- Sergiu Gatlan
- April 02, 2021
- 01:04 PM
- 0
Google: North Korean hackers target security researchers again

Google's Threat Analysis Group (TAG) says that North Korean government-sponsored hackers are once again targeting security researchers using fake Twitter and LinkedIn social media accounts.
- Sergiu Gatlan
- March 31, 2021
- 01:33 PM
- 1
Facebook blocks Chinese state hackers targeting Uyghur activists

Facebook took down accounts used by a Chinese-sponsored hacking group to deploy surveillance malware on devices used by Uyghurs activists, journalists, and dissidents living outside China.
- Sergiu Gatlan
- March 24, 2021
- 04:17 PM
- 0
Chinese nation state hackers linked to Finnish Parliament hack

Chinese nation-state hackers have been linked to an attack on the Parliament of Finland that took place last year and led to the compromise of some parliament email accounts.
- Sergiu Gatlan
- March 18, 2021
- 09:10 AM
- 0
The Microsoft Exchange hacks: How they started and where we are

The emergency patches for the recently disclosed critical vulnerabilities in Microsoft Exchange email server did not come soon enough and organizations had little time to prepare before en masse exploitation began.
- Ionut Ilascu
- March 16, 2021
- 03:29 AM
- 0
More hacking groups join Microsoft Exchange attack frenzy

More state-sponsored hacking groups have joined the ongoing attacks targeting tens of thousands of on-premises Exchange servers impacted by severe vulnerabilities tracked as ProxyLogon.
- Sergiu Gatlan
- March 10, 2021
- 09:42 AM
- 2
State hackers rush to exploit unpatched Microsoft Exchange servers

Multiple state-sponsored hacking groups are actively exploiting critical Exchange bugs Microsoft patched Tuesday via emergency out-of-band security updates.
- Sergiu Gatlan
- March 03, 2021
- 10:30 AM
- 0
North Korean hackers target defense industry with custom malware

A North Korean-backed hacking group has targeted the defense industry with custom backdoor malware dubbed ThreatNeedle since early 2020 with the end goal of collecting highly sensitive information.
- Sergiu Gatlan
- February 25, 2021
- 11:14 AM
- 0