Skip to content
Threat Feed
Subscribe

Tag

Cyberespionage

5 briefs RSS
high advisory

Rival Espionage Actors Converge on Pakistani Law Enforcement

Suspected China- and India-nexus threat actors conducted separate cyberespionage operations against several Pakistani law enforcement organizations, including Balochistan Police, from February 2024 to April 2026, compromising web applications and network appliances with tools like PlugX, ShadowPad, Cobalt Strike, and Remcos to exfiltrate sensitive criminal and biometric data.

web applications +2 cyberespionage nation-state data-exfiltration web-application command-and-control malware
1r 7t 13i
high threat

GreyVibe Targets Ukraine with AI-Generated Lures and Custom Malware

The likely Russian-aligned GreyVibe group is targeting Ukrainian organizations with AI-generated lures delivered via spear-phishing and malicious websites, deploying custom malware such as PhantomRelay, LegionRelay, and FallSpy to exfiltrate sensitive data.

google drive +8 GreyVibe ai-generated-lures cyberespionage ukraine malware phantomrelay legionrelay fallspy
2r 8t
high threat

Screening Serpens APT Targets Tech and Defense Sectors with New RATs

The Iranian APT group Screening Serpens targeted the tech and defense sectors in the U.S., Israel, and the UAE between February and April 2026, deploying six new RAT variants from the MiniUpdate and MiniJunk V2 malware families, using tailored social engineering lures and AppDomainManager hijacking.

MiniUpdate +2 Screening Serpens APT Iran RAT MiniJunk DLL Sideloading AppDomainManager Cyberespionage
2r 3t
high threat

FrostyNeighbor Targets Ukraine with Updated PicassoLoader Chain

The FrostyNeighbor threat actor is targeting Ukrainian governmental organizations with spearphishing emails containing malicious PDFs that deliver a JavaScript dropper (PicassoLoader) and ultimately a Cobalt Strike beacon.

PoC Cobalt Strike +8 FrostyNeighbor cyberespionage cobaltstrike picassoloader ukraine
2r 3t 5c 16i updated
high threat

MuddyWater Disguises Cyber-Espionage as Chaos Ransomware Attack

The MuddyWater group is disguising its cyber-espionage operations as Chaos ransomware attacks, using Microsoft Teams social engineering for initial access and establishing persistence, likely to complicate attribution and mask their true objectives.

Microsoft Teams +3 MuddyWater chaos ransomware cyberespionage data theft iranian apt
2r 5t