Tag
Vapor Panda: Automated Cyber Espionage via ARTEX Framework
Vapor Panda (formerly VexatiousTemper, overlapping with Earth Estries) is utilizing the AI-powered ARTEX framework to conduct large-scale, concurrent, multi-vector intrusions targeting over 200 global organizations, including foreign ministries, telecommunications, and defense sectors.
Integrity Technology Group Enabling Global Cyber Espionage
2 TTPsThe NCSC and international partners have exposed Integrity Technology Group for facilitating global cyber espionage campaigns through AI-powered scanning, large-scale botnets, and manual network exploitation.
China-Linked Espionage Campaign Targeting Global Infrastructure via Integrity Technology Group
3 TTPs 6 CVEs 2 IOCsIntegrity Technology Group, a Chinese for-profit entity, is conducting multi-year cyber espionage targeting government, healthcare, and religious institutions using automated vulnerability scanning, credential harvesting, and specialized data exfiltration tools.
Elevation of Privilege Vulnerability in Microsoft Exchange Server
1 rule 5 TTPs 1 CVECVE-2026-96940 is an elevation of privilege vulnerability in Microsoft Exchange Server that allows authenticated attackers to escalate privileges within the server environment.
China-Aligned FamousSparrow Deploys SparroWocky Backdoor in Latin America
1 rule 4 TTPs 1 IOCThe state-sponsored threat actor FamousSparrow is deploying the new modular SparroWocky C++ backdoor against government entities in Latin America using advanced anti-analysis techniques.
Generative Threat Groups Automating Cyber Operations with AI
3 TTPsAnthropic has documented multiple threat actors leveraging AI models to automate end-to-end cyberattack workflows including reconnaissance, vulnerability research, credential harvesting, and large-scale data exfiltration.
Armored Likho APT Deploys Rust-Based Still Toolkit for Espionage
1 rule 3 TTPs 2 IOCsThe Armored Likho (Eagle Werewolf) threat actor is deploying a new Rust-based cyber-espionage 'Still Toolkit' via a malicious fundraising-themed dropper to exfiltrate Telegram session data and perform covert audio surveillance.
OctLurk and SilkLurk Memory-Resident Backdoors Targeting Central Asia
1 rule 4 TTPs 6 IOCsOctLurk and SilkLurk are sophisticated, memory-resident backdoors targeting government and research entities in Central Asia since January 2025, utilizing machine-specific key derivation for payload decryption and modular plugin injection.
Mirage Kitten Targets Middle East and Africa with New Malware
4 rules 13 TTPs 3 IOCsMirage Kitten, an advanced persistent threat (APT) group, is deploying new Windows backdoor (NightLedger) and WebSocket tunnelers (ArcBridge, BridgeHead) via spear-phishing campaigns to conduct cyber-espionage and data exfiltration against aerospace, aviation, defense, and telecommunications sectors in the Middle East and Europe.
Multi-Group Espionage Targets Pakistani Law Enforcement via Weaponized Police Portal
3 rules 5 TTPs 5 IOCsSuspected China- and India-aligned threat actors conducted sustained cyber espionage campaigns between February 2024 and April 2026, compromising Pakistani law enforcement organizations' web applications, network appliances, and email gateways, including the Balochistan Police's Complaint Management System to deploy malware like PlugX, ShadowPad, Cobalt Strike, Remcos RAT, a Rust stager (cms_plugin.exe), and AsyncRAT.
WindShift APT Targeting Middle East with OSX.WindTail macOS Implant
2 rules 1 TTPThe WindShift APT group is targeting Middle Eastern governments with a first-stage macOS implant called OSX.WindTail, abusing custom URL schemes for initial infection and establishing persistence via login items, while decrypting embedded strings to identify file extensions of interest.