Chinese APT Exploits BeyondTrust API Key to Access U.S. Treasury Systems and Documents The United States Treasury Department said it suffered a “major cybersecurity incident” that allowed suspected Chinese threat actors to remotely access some computers and unclassified documents. “On December 8, 2024, Treasury was notified by a third-party software Read more…
Bitter APT Targets Turkish Defense Sector with WmRAT and MiyaRAT Malware A suspected South Asian cyber espionage threat group known as Bitter targeted a Turkish defense sector organization in November 2024 to deliver two C++-malware families tracked as WmRAT and MiyaRAT. “The attack chain used alternate data streams in a Read more…
The Mask APT Resurfaces with Sophisticated Multi-Platform Malware Arsenal A little-known cyber espionage actor known as The Mask has been linked to a new set of attacks targeting an unnamed organization in Latin America twice in 2019 and 2022. “The Mask APT is a legendary threat actor that has been Read more…
Researchers Uncover Espionage Tactics of China-Based APT Groups in Southeast Asia A suspected China-based threat actor has been linked to a series of cyber attacks targeting high-profile organizations in Southeast Asia since at least October 2023. The espionage campaign targeted organizations in various sectors spanning government ministries in two different Read more…
Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor The China-aligned advanced persistent threat (APT) actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia. That’s according to findings from cybersecurity firm ESET based Read more…
SideWinder APT Strikes Middle East and Africa With Stealthy Multi-Stage Attack An advanced persistent threat (APT) actor with suspected ties to India has sprung forth with a flurry of attacks against high-profile entities and strategic infrastructures in the Middle East and Africa. The activity has been attributed to a group Read more…
Dancho Danchev’s Blog – Mind Streams of Information Security Knowledge: Dynamic DNS Service Providers for APT Command and Control (C&C) Dear blog readers, The following is a compilation of dynamic DNS providers in specific ones used by APTs and various other targeted campaign obtained using public sources. Sample dynamic DNS Read more…
Iranian APT UNC1860 Linked to MOIS Facilitates Cyber Intrusions in Middle East An Iranian advanced persistent threat (APT) threat actor likely affiliated with the Ministry of Intelligence and Security (MOIS) is now acting as an initial access facilitator that provides remote access to target networks. Google-owned Mandiant is tracking the Read more…
Inside Operation Diplomatic Specter: Chinese APT Group's Stealthy Tactics Exposed Governmental entities in the Middle East, Africa, and Asia are the target of a Chinese advanced persistent threat (APT) group as part of an ongoing cyber espionage campaign dubbed Operation Diplomatic Specter since at least late 2022. “An analysis of this threat Read more…
Kimsuky APT Deploying Linux Backdoor Gomir in South Korean Cyber Attacks The Kimsuky (aka Springtail) advanced persistent threat (APT) group, which is linked to North Korea’s Reconnaissance General Bureau (RGB), has been observed deploying a Linux version of its GoBear backdoor as part of a campaign targeting South Korean organizations. The backdoor, Read more…