APT groups, nation-state activity, campaign tracking
RSS feed for this categoryA China-linked hacking group, Armory Castle, exploited a zero-day vulnerability in BeyondTrust Remote Support in late August 2026. The vulnerability, CVE-2026-102764, with a CVSS score of 9.3, allowed attackers to take control of remote support servers.
Russia has arrested members of the DataSuckers hacking group, while other news includes Al Jazeera employees being targeted with Candiru spyware and the US disrupting North Korean laptop farms. Additionally, an OpenAI employee was arrested for planting a spy device.
F-Secure has launched a new 'Victim-First Scam Encyclopedia' drawing on decades of threat intelligence. The resource aims to educate consumers by explaining over 50 types of common fraud from the perspective of those who have been targeted. It also tracks the evolution of cyber crime tactics.
A recent incident has confirmed the delivery of mercenary spyware through targeted advertisements, utilizing zero-click exploits. This marks the first documented instance of such an attack vector being used to deploy this type of malware.
Researchers issued warnings in August that attackers could potentially exploit vulnerabilities to disrupt French supermarkets. Months later, these supermarkets experienced cyberattacks, suggesting the warnings may have been overlooked.
Citizen Lab researchers have traced zero-click spyware infections at Al Jazeera to targeted online advertisements. The Candiru spyware, sold to governments, exploited devices the moment an ad loaded on screen, sometimes even when the ad loaded out of sight.
The threat actor Silent Lynx has been linked to attacks on CIS government entities, employing various infection methods. These include macro-enabled documents, PS2EXE downloaders, GitHub-hosted PowerShell, and specifically crafted WinRAR archives.
A long-running Traffic Distribution System (TDS) named Help TDS, linked to the Russian-language affiliate program Hotejka, is reportedly directing over 20,000 Cloudflare Pages domains to host tech support scams. This operation has been active since at least 2017, distributing PHP code templates to affiliates for use on compromised websites.
X (formerly Twitter) has removed over 13,000 accounts suspected of engaging in coordinated inauthentic behavior. The platform cited links to Iran, Russia, and China, though it did not provide public evidence for these attributions.
Law enforcement from 17 countries, coordinated by INTERPOL, have arrested 95 suspects in an operation targeting the distribution of child sexual abuse material (CSAM) online. The crackdown focused on messaging groups used for illicit content sharing.
US Air Force pilots in Afghanistan reportedly used malware-laden USB drives to plan missions. The article criticizes this practice, implying a lack of proper security protocols within the military.
A credential-theft campaign dubbed GhostAction has significantly increased its activity, targeting over 30,000 repositories belonging to approximately 3,000 users and organizations. This surge is attributed to the compromise of around 1,900 GitHub accounts, from which attackers attempted to exfiltrate secrets from CI/CD pipelines within public repositories.
Microsoft, in collaboration with international authorities and tech companies, has dismantled "Yam Store," a criminal marketplace facilitating phishing-as-a-service (PhaaS). This operation led to the takedown of a network responsible for over 1 billion malicious messages and the theft of credentials and data.
A cybercrime marketplace known as Yam Store has been identified as the source of cloud infrastructure and phishing kits used to send over one billion phishing messages globally. This operation highlights a significant organized effort in facilitating phishing attacks.
The U.S. Department of Justice has disrupted the Famous Chollima threat group's operations by arresting two individuals and charging 14 more in connection with North Korean remote IT worker schemes. Law enforcement seized nearly 187 laptops that were being used to facilitate these operations, which aimed to generate revenue for North Korea.
Microsoft, in collaboration with several security organizations and private companies, has disrupted three major phishing kits known as CoGUI, Haozi, and Iron Man System. These kits have been linked to the generation of over one billion scam messages since January 2026.
The U.S. Department of Justice has charged 14 individuals and seized over 180 computers as part of an operation to dismantle a North Korean scheme involving fraudulent remote IT workers. The conspiracy is reported to have affected more than 70 U.S. companies.
The United Kingdom has imposed sanctions on Cryptomus, a cryptocurrency platform accused of facilitating illicit financial transactions. These transactions are linked to ransomware, darknet markets, fraud, and cybercrime services, which allegedly help Russia evade financial restrictions.
Law enforcement agencies and international partners have disrupted a large cybercriminal network responsible for sending over one billion phishing messages. This operation targeted a significant ecosystem that enabled these malicious communications, impacting over 75,000 organizations globally.
A Russian influence operation, leveraging AI, has been widely targeting Latin America. The operation utilized spoofed emails and fabricated government documents, alongside the establishment of a local organization, to conduct its activities, with schools in Peru and Ecuador being among the targets.
Microsoft, with the support of Health-ISAC and a federal court order, has successfully disrupted a significant Chinese-language phishing operation. The operation, responsible for over one billion phishing messages, was taken down by seizing domains associated with YAM Store, CoGUI, and Iron Man.
US investigators have conducted a crackdown on North Korean IT worker operations, raiding 40 locations in Texas and seizing 187 laptops. These laptops were allegedly used by North Korean workers to mask their real locations while performing freelance work.
An OpenAI engineer has been charged by the FBI with allegedly planting covert listening devices within the company's offices. One device was reportedly found in a conference room, disguised and wrapped in toilet paper, while a second was found in the engineer's bag.
Organizations are reporting an alarming trend where ransomware gangs are escalating their tactics to include physical threats, family stalking, and even abduction against employees. However, verifying the authenticity and prevalence of these extreme claims is proving difficult.
An OpenAI employee, Abdulrahman Alfozan, has been arrested for allegedly planting a hidden recording device in an executive conference room. The device was reportedly used to covertly record sensitive conversations within the company's San Francisco offices. Alfozan faces charges related to the illegal interception of oral communications.
Abdulrahman Alfozan, a Saudi national employed by OpenAI, was arrested on Friday after a listening device was discovered in a company conference room. He was subsequently terminated from his position.
A Saudi national employed as an engineer at OpenAI has been arrested for allegedly installing a covert recording device in a conference room at the company's San Francisco headquarters. The device was reportedly intended to capture confidential discussions.
North Korea is conducting phishing attacks against Ukrainian individuals to gather intelligence about the war effort. These attacks rely on simple reply-baiting tactics.
Meta has reported a data breach on GitHub where hackers accessed proprietary code and personal data of approximately 1,500 individuals, primarily Meta employees in the United States. Affected employees are being offered credit monitoring services.
Edward Dubrovsky, a prominent cybersecurity executive and ransomware negotiator, has been arrested and charged with conspiracy to extort money. The charges were filed in Pennsylvania.
Attackers exploited a newly disclosed helpdesk zero-day vulnerability within hours of its announcement, highlighting the rapid pace of exploitation. Concurrently, individuals offering to remediate ransomware incidents were themselves found to be involved in questionable practices, indicating a dual threat landscape.
Ukrainian drone strikes have targeted Yandex datacenters, causing significant disruptions to cloud services and payment systems. Users are experiencing prolonged outages, with network connectivity reportedly falling to 30% of its normal capacity, and IT teams are working to restore services.
Oleg Korniev, a leader of the sophisticated money laundering network YMCO, has pleaded guilty in the US. YMCO facilitated the movement of funds for cybercriminals outside of the United States.
A Canadian cybersecurity executive, believed to be Edward Dubrovsky, has been arrested in the United States in connection with an FBI probe into the ShinyHunters hacking group. Dubrovsky was reportedly in the U.S. attending a conference at the time of his arrest.
This article discusses how AI might make human hacking groups like Shiny Hunters obsolete. It highlights the arrest of some individuals and a specific instance where AI discovered a bug that humans would likely have missed, demonstrating its potential to advance threat capabilities.
Cybersecurity researchers have identified a new AI-augmented campaign targeting WordPress sites, e-commerce platforms, and critical infrastructure in Ukraine. This campaign, dubbed CyberXero, uses commodity offensive tools like Cobalt Strike combined with an AI orchestration layer powered by Anthropic's Claude Code. The campaign has already succeeded in stealing over 628,000 Ukrainian records.
Law enforcement has arrested members of the ShinyHunters hacking group in the US and Jordan. In related news, hackers compromised TLD registrars to obtain Google certificates, a member of the Qilin ransomware group was apprehended in Japan, and Google has temporarily halted its Open Source Vulnerability Research Program due to an influx of AI-generated spam.
Canadian cybersecurity executive Edward Dubrovsky has been arrested in Pennsylvania on suspicion of involvement in extortion activities. These activities are reportedly linked to the FBI's efforts to combat the ShinyHunters hacking group.
A Chinese hacker utilized the ARTEX AI penetration testing suite and Claude agents to conduct cyberattacks against South Korean banks. The attacks targeted the financial sector earlier this month, with the hacker leveraging these AI tools for their operations.
A former infrastructure engineer at an industrial firm has been sentenced to prison for an insider cyber extortion plot. The engineer deleted admin accounts, reset numerous passwords, and demanded 20 bitcoin to prevent damage to the company's servers.
The FBI has arrested the co-founder of a Canadian cybersecurity firm allegedly involved with the ShinyHunters hacking group. This group is accused of recently breaching the FBI and exfiltrating sensitive data concerning thousands of agents.
Cybersecurity researchers have uncovered a credential-stealing campaign that compromised two prominent open-source maintainer accounts. The attackers injected a malicious GitHub Actions workflow into over 340 repositories, including those associated with the author of the pyxel game engine.
The FBI has arrested another individual suspected of involvement with the ShinyHunters extortion group. This group previously claimed to have breached the FBI's jobs portal, compromising sensitive data of agents and applicants.
Dark Reading editors discuss recent cybersecurity news that didn't receive full coverage, including the FBI's action against a suspected ShinyHunters operative and a security incident at a Pentagon-run data center.
The FBI has arrested another individual suspected of being a member of the ShinyHunters extortion group. This arrest is reportedly linked to a recent breach of FBI systems.
This article argues that the families of executives are increasingly becoming targets for cyberattacks, as attackers seek to exploit personal relationships to gain access to sensitive corporate information or systems. It emphasizes the need for security training to extend beyond the workplace to include the families of key personnel.
The owner of a ransomware remediation company, Zohar Pinhasi, faces wire fraud charges for allegedly defrauding clients. Pinhasi claimed to recover encrypted data without paying ransoms but is accused of actually paying cybercriminals and charging clients significantly more than the ransom amount.
German authorities have arrested a Russian national suspected of being a key member of the Qilin ransomware group. The suspect was extradited from Japan earlier this month.
The article discusses how the increasing authority of AI agents over business systems presents a new attack vector. Attackers can potentially manipulate these AI agents, similar to how they currently conduct business email compromise (BEC) attacks against human victims.
CISA has added five vulnerabilities exploited by the China-linked Flax Typhoon threat actor to its Known Exploited Vulnerabilities (KEV) catalog. Federal agencies are given an October 11 deadline to patch these flaws. One of the listed vulnerabilities is CVE-2015-3306 in ProFTPD, which has a critical CVSS score of 10.0.
