Skip to content
Threat Feed
Subscribe

Tag

State-Sponsored

7 briefs RSS
critical threat

Russian State-Backed 'LAUNDRY BEAR' Exploits Zimbra Zero-Click Vulnerability

The Russian state-supported threat group LAUNDRY BEAR is exploiting a zero-click vulnerability, dubbed 'beehive,' in the Zimbra Collaboration Suite (ZCS) webmail service, actively stealing sensitive emails and gaining persistent access to compromised networks since July 2025 by merely viewing a malicious email, with Western organizations across various sectors being targeted.

Zimbra Collaboration Suite LAUNDRY BEAR phishing zero-click espionage state-sponsored zimbra email-theft
3t
critical threat

TA488 Exploits Zimbra Mailservers with Half-Click Vulnerability CVE-2025-66376

Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.

PoC Zimbra Collaboration Suite +10 TA488 +2 espionage xss zimbra apt state-sponsored half-click cve-2025-66376
2r 9t 3c 7i updated
high threat

UAC-0145 Uses ClickFix CAPTCHAs to Distribute Data-Stealing Malware

Russian state-sponsored threat actor UAC-0145 (Sandworm sub-cluster) is actively targeting Ukrainian organizations by using fake ClickFix CAPTCHAs on compromised websites to trick users into executing malicious PowerShell commands, leading to the deployment of data-stealing malware on Windows and Android devices.

UAC-0145 malware state-sponsored data-theft social-engineering windows android ukraine backdoor
2r 9t
high threat

NCSC Warns of State-Sponsored Espionage via IP Cameras Targeting Critical Infrastructure

Russian state-sponsored actors, along with hacktivist groups and cybercriminals, are exploiting IP cameras to spy on critical infrastructure in NATO countries, including the Netherlands, prompting NCSC to advise organizations and home users to secure their devices through updates, network segmentation, and attack surface reduction.

Russian state-sponsored actors ip-camera espionage critical-infrastructure state-sponsored advisory network-segmentation security-best-practices
2t
critical threat

FortiBleed Campaign: 73,932 FortiGate Systems Credentials Exposed

A Russian-speaking threat group utilized a large dataset of administrative and VPN credentials, likely sourced from exposed FortiGate configuration files and active credential harvesting, to access government, critical infrastructure, and multinational corporate networks, resulting in widespread data exfiltration.

FortiGate +1 Russian-speaking threat group credential-theft fortios state-sponsored espionage data-exfiltration russian-speaking critical-infrastructure government
3r 9t 1i
high advisory

CrowdStrike 2026 Technology Threat Landscape Report: China's Ambitions Fuel Attacks

The CrowdStrike 2026 Technology Threat Landscape Report highlights the pervasive targeting of the technology sector by China-nexus and eCrime adversaries, employing tactics like password spraying, vulnerability exploitation, supply chain compromises (e.g., Axios npm package, GitHub repositories), and malware distribution (macOS info stealers via OpenClaw lures) to achieve intelligence collection, intellectual property theft, and financial extortion.

Axios npm package +1 intelligence-collection espionage supply-chain-compromise software-supply-chain extortion state-sponsored ecrime macos +1
2r 6t
high advisory

State-Sponsored Actors Leveraging Vulnerabilities and Identity for Persistent Access (2025)

In 2025, state-sponsored actors from China, Russia, North Korea, and Iran leveraged vulnerabilities and identity compromise for initial access, focusing on persistence for long-term espionage or disruption.

state-sponsored apt persistence vulnerability-exploitation
2r 6t