State-Sponsored

The US government disrupted infrastructure supporting Integrity Technology Group tools MicroScan and FishHub, which Chinese state-sponsored actors, including Flax Typhoon, used to compromise critical infrastructure.

The state-sponsored threat actor FamousSparrow is deploying the new modular SparroWocky C++ backdoor against government entities in Latin America using advanced anti-analysis techniques.

The Russian state-supported threat group LAUNDRY BEAR is exploiting a zero-click vulnerability, dubbed 'beehive,' in the Zimbra Collaboration Suite (ZCS) webmail service, actively stealing sensitive emails and gaining persistent access to compromised networks since July 2025 by merely viewing a malicious email, with Western organizations across various sectors being targeted.

Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.

Russian state-sponsored threat actor UAC-0145 (Sandworm sub-cluster) is actively targeting Ukrainian organizations by using fake ClickFix CAPTCHAs on compromised websites to trick users into executing malicious PowerShell commands, leading to the deployment of data-stealing malware on Windows and Android devices.

The Turla APT group, attributed to the 16th Center of Russia's Federal Security Service (FSB), has been observed targeting and compromising French entities since at least 2004 for intelligence gathering, impacting ministries and organizations in diplomatic, defense, justice, and technology sectors, with ongoing campaigns against NATO and EU countries.

Russian state-sponsored actors, along with hacktivist groups and cybercriminals, are exploiting IP cameras to spy on critical infrastructure in NATO countries, including the Netherlands, prompting NCSC to advise organizations and home users to secure their devices through updates, network segmentation, and attack surface reduction.

A Russian-speaking threat group utilized a large dataset of administrative and VPN credentials, likely sourced from exposed FortiGate configuration files and active credential harvesting, to access government, critical infrastructure, and multinational corporate networks, resulting in widespread data exfiltration.

The CrowdStrike 2026 Technology Threat Landscape Report highlights the pervasive targeting of the technology sector by China-nexus and eCrime adversaries, employing tactics like password spraying, vulnerability exploitation, supply chain compromises (e.g., Axios npm package, GitHub repositories), and malware distribution (macOS info stealers via OpenClaw lures) to achieve intelligence collection, intellectual property theft, and financial extortion.

In 2025, state-sponsored actors from China, Russia, North Korea, and Iran leveraged vulnerabilities and identity compromise for initial access, focusing on persistence for long-term espionage or disruption.

In 2025, state-sponsored actors from China, Russia, North Korea, and Iran leveraged vulnerabilities and identity compromise for initial access, focusing on persistence for long-term espionage or disruption.