Iranian threat actor UNC2428 deployed the MURKYTOUR backdoor in a job-themed social engineering campaign targeting Israelis in October 2024. Posing as recruiters from defense contractor Rafael, attackers directed victims to a fake website to download "RafaelConnect.exe," which installed ma...
Russian state-backed hacking group Gamaredon has targeted a Western military mission in Ukraine using an enhanced version of GammaSteel malware. The February-March 2025 attacks began with malicious .LNK files on removable drives. The group has evolved to use PowerShell-based tools with str...
Earth Alux, a newly identified China-linked threat actor, has been targeting critical sectors across Asia-Pacific and Latin America since early 2023. The group focuses on government, technology, logistics, and other key industries in Thailand, Philippines, Malaysia, Taiwan, and Brazil. The...
This report details a China-linked APT group Aquatic Panda's global espionage campaign called "Operation FishMedley" that targeted government entities, Catholic charities, NGOs, and think tanks across six countries in 2022. The ten-month operation employed multiple malware families commonl...
Chinese hacking group MirrorFace has expanded beyond its traditional Japanese targets to attack a European diplomatic organization using a revived ANEL backdoor. Discovered by ESET in August 2024, Operation AkaiRyū employed sophisticated techniques including spear-phishing, DLL side-loadi...
