Tag

Apt

4 briefs RSS

State-Sponsored Actors Leveraging Vulnerabilities and Identity for Persistent Access (2025)

In 2025, state-sponsored actors from China, Russia, North Korea, and Iran leveraged vulnerabilities and identity compromise for initial access, focusing on persistence for long-term espionage or disruption.

state-sponsored apt persistence vulnerability-exploitation

2r 6t 2w ago

high threat

Operation GhostMail: Russian APT Exploiting Zimbra XSS to Target Ukraine Government

2 rules 1 TTP

A Russian APT group is exploiting a Zimbra XSS vulnerability (details unspecified) to target the Ukrainian government in an operation dubbed 'GhostMail'.

Russian APT zimbra xss ukraine apt

2r 1t Mar 20, 2026

medium advisory

Maltrail IOC Feed Update for Multiple Threats

3 rules 6 TTPs 50 IOCs

This brief summarizes IOCs extracted from the Maltrail feed on March 15, 2026, covering domains and URLs associated with threats targeting macOS and Android platforms, including OSX_Atomic, FakeApp, Android_Joker, Lummack2, APT_Sidewinder, APT_Kimsuky, and Hak5Cloud_C2.

maltrail ioc osx android apt

3r 6t 50i Mar 15, 2026

medium advisory

Maltrail IOCs Report: Tracking Multiple Threat Actors

3 rules 5 TTPs 27 IOCs

This brief analyzes IOCs aggregated by Maltrail on February 27, 2026, highlighting network activity associated with diverse threat actors including APT_UNC2465, Lazarus Group, Gorat, APT_Bitter, Android_Joker, PowerShell Injector, SmokeLoader, and FakeApp campaigns targeting various sectors.

maltrail threat-intelligence apt malware

3r 5t 27i Feb 27, 2026