Threat actors

Russian cyber operations globally target critical infrastructure, communication platforms, and military logistics. Attacks on Zimbra servers, Signal and other messaging services, as well as on NATO transportation routes, demonstrate a broad threat landscape. Social engineering and weaknesses in security architectures are exploited. These activities particularly affect Western states and Ukraine.

TeamPCP is a threat group known for large-scale supply chain attacks on open source ecosystems. They target package managers like npm and PyPI to inject malicious code into widely used libraries. The campaign involves container escape techniques and is documented under the name 'Mini Shai-Hulud'. Their activities have been observed through mid-2026 and pose a significant risk to the software supply chain.

Turla is a Russian cyber espionage group. Recent reports show attacks on government institutions, especially Exchange servers, using new malware such as Cereal and STOCKSTAY. Affected countries include Kazakhstan, Romania and Ukraine. The EU has imposed sanctions on Russia over Turla activities.

APT29 is a Russian state-sponsored cyber actor. Recent reporting describes watering hole attacks targeting thousands of mobile users and hijacking web analytics scripts to deliver iOS and Android exploits. SentinelOne blocked the CaptiveCrunch campaign. The actor also used Claude to rebuild malware and employs ROADtools for cloud tactics.

Volt Typhoon is a Chinese threat actor that exploits Cisco SD-WAN zero-day vulnerabilities using the covert, ephemeral 'Silent Train' network. The attacks include four zero-day exploitation campaigns. There are concerns about potential attacks on the US water supply. Researchers have uncovered the actor's covert network.

HAFNIUM is a Chinese threat actor, with the US offering a $10 million reward for an accused hacker. The reporting mentions several remote code execution vulnerabilities in Microsoft Exchange Server, including CVE-2022-41082, CVE-2021-26858, CVE-2021-27065, and CVE-2021-26857. These vulnerabilities are associated with HAFNIUM, although the headlines do not specify targets or malware.

Star Blizzard is a Russian state-sponsored hacking group (APT). The group uses a new technique called RedFlick to distribute malware. It is expanding its targeting to Ukraine and beyond. In recent attacks, over 100 organizations were targeted with fake event invitations to deliver a backdoor.

Qilin is a ransomware group that, according to recent reports, exploits a PAN-OS authentication bypass and a Check Point VPN zero-day vulnerability to gain initial access. The attacks are linked to Qilin ransomware. No specific targeted sectors, regions, or countries were mentioned in the headlines.

Iran has been linked to cyberattacks on cooling systems in France. U.S. federal agencies have broadened alerts on Iran-linked attacks on operational technology. Iranian cyber activities are increasingly focusing beyond critical infrastructure. Despite a ceasefire, Iranian hackers continue their attacks.

Sandworm is a Russia-linked threat actor group known for destructive attacks against Ukraine. Recent reporting highlights the use of a new mesh network backdoor in a destructive attack and collaboration with other Russian hackers to wipe data at a Ukrainian grain firm. The group has also chained Cisco vulnerabilities to deploy Cyclops Blink malware, and there are indications of SANDWORM_MODE related to AI toolchain supply chain attacks.

Storm-0940 is a China-linked threat group associated with a supply chain attack targeting ConnectWise. The attackers use the ARTEX AI agent platform to conduct large-scale, state-aligned campaigns. Microsoft attributed the incident to a China-state aligned threat group. The campaign enabled a supply chain compromise.

Russian state-sponsored APT actors are reportedly increasingly using AI tools like Claude AI to automate malware evasion. They target network devices and routers, with officials again warning about this threat. Additionally, a WinRAR vulnerability is being exploited against Ukrainian organizations. The attacks particularly affect Ukraine and critical network infrastructure.

The Lazarus Group uses post-quantum cryptography for malware delivery. In Operation FlashHole, Lazarus breaks security and defies control. The Contagious Interview campaign compromised 30,000 devices and stole $10.71 million in cryptocurrency.

SafePay is a ransomware gang that according to CISA has hit over 600 critical infrastructure organizations. The FBI describes the SafePay ransomware group as among the most active, with more than 600 victims since 2024. The reporting comes from a joint CISA and FBI advisory under the #StopRansomware initiative.

Recent reporting links APT28 to hacking of defense contractors in two NATO allied countries. Russia's FSB is blamed for an attack on Poland's power grid. In response, the UK and EU imposed first joint cyber sanctions. The activities are attributed to Russia.

Armory Castle is a threat actor linked in recent reporting to the exploitation of a zero-day vulnerability in BeyondTrust Remote Support. Reports indicate Chinese APT or China-linked hackers exploited the vulnerability to take over remote support servers. The incidents continue the trend of exploited edge vulnerabilities.

Flax Typhoon is a Chinese state-sponsored cyber actor. Recent reports indicate the actor exploits five vulnerabilities and targets U.S. federal agencies and critical infrastructure. The U.S. and FBI disrupted Chinese hacking tools used to breach critical infrastructure. CISA set an October 11 deadline for federal agencies.

WaterPlum is a North Korean hacking group. The group has infected over 30,000 devices worldwide across more than 100 countries. The attackers exploit job offers to steal cryptocurrency and data. International security agencies warn about this campaign.

UAT-10147 is a Chinese-speaking threat actor that integrates agentic AI into post-compromise operations. The actor deploys SPECTRE, a cross-platform implant with Linux rootkit and BYOVD capabilities. The headlines do not specify targeted sectors, regions, or countries.

Laundry Bear is a Russian threat group that exploits zero-click vulnerabilities in Zimbra webmail. They recently used a zero-day flaw in Zimbra against targets in the US and Ukraine. International alerts highlight the Russia-linked attacks on Zimbra.

Nightmare Eclipse is a threat actor associated with the 'RoguePlanet' zero-day vulnerability. Recent reports indicate that Microsoft is working on a patch for this exploit. There is no further information on targeted sectors or regions.

Gamaredon is a Russian APT group that is expanding its attacks on Ukraine. Recent reports indicate the use of new malware and cloud service abuse. The group has upgraded its arsenal and exploits vulnerabilities such as WinRAR to deliver malware like GammaWorm and GammaSteel.

The Gentlemen is a Ransomware-as-a-Service group known for using custom backdoors and evolving tactics. They employ the GentleKiller EDR framework to disable up to 400 security processes. Their ransomware spreads like a worm and has claimed 478 victims.

China conducts cyber espionage targeting universities and other organizations. German domestic intelligence warns of increased vigilance at universities. Google has exposed a Chinese espionage group that has been undetected in networks since 2023. Additionally, a dual-method cyberattack was launched against Czech organizations.

Vapor Panda is a China-backed threat group using the agentic AI pentesting tool ARTEX. It reportedly compromised 140 sensitive targets in 11 days. The group also targeted over 200 organizations worldwide. The activity demonstrates use of AI-powered tools for offensive cyber operations.

Warp Panda is a China-linked threat actor that reportedly exploited a low-severity ESXi logging vulnerability as a zero-day. The actor targeted VMware ESX systems to reduce audit trail visibility. The exploitation was intended to decrease the visibility of audit logs and obscure malicious activity.

UNC5221 is a prolific Chinese espionage group. The group exploited a zero-day vulnerability in BeyondTrust. It also deployed new malware to maintain access to compromised networks. These activities indicate ongoing espionage operations.

Warlock is a threat actor using ransomware and exploiting SharePoint vulnerabilities. Recent reports show attacks on water and telecommunications operators. The actor is expanding SharePoint exploitation into critical infrastructure attacks.

JadePuffer conducts agentic AI attacks targeting Azure environments. The actor compromises Azure tenants and destroys cloud resources. The attacks are described as destructive cloud attacks.

UTA0565 is a China-aligned threat group. According to reports, it exploits a zero-day chain in Chrome and Windows to deploy the CLEANGULP malware. Volexity identified the group as another China-aligned actor exploiting vulnerabilities in Chrome and Microsoft products. Further details on target sectors or regions are not available from the headlines.

Nightmare-Eclipse is a threat actor that, according to headlines, repeatedly uses Windows exploits. Recently, the exploits 'ShieldCrash' and 'RoguePlanet' targeting Microsoft systems were reported. Specific details on targeted sectors, regions, or countries are missing from the reports.

Void Blizzard is a suspected Russian cyber espionage group. They exploited a zero-click vulnerability in Zimbra for email theft. A Russian national has been charged in connection with the group's espionage campaign. No further details on targeted sectors or regions are evident from the recent headlines.

The Chaos ransomware group uses msaRAT to route command-and-control traffic through headless Chrome and Edge browsers. This creates a covert C2 channel that disguises itself as normal browser traffic. It enables undetected control of the infection. The technique leverages legitimate browser processes for concealment.

ShinyHunters is a threat actor group known for abusing OAuth in SaaS-based applications. Recent reports highlight the need to defend SaaS applications against such attacks. The group targets cloud services. No specific malware details are evident from the provided headlines.

UAT-7810 is a China-linked threat actor expanding its ORB network with the new LONGLEASH malware. The actor reportedly achieves a 54% success rate in its operations.

ToddyCat is a threat actor that, according to a Q1 2026 threat landscape report, targets industrial automation systems. The actor is also associated with a hidden email assistant, indicating email-based espionage. These capabilities suggest a focus on industrial espionage.

North Korean hackers are increasingly conducting supply chain attacks to compromise open source software. These campaigns aim to infiltrate developers and organizations. Microsoft recently linked a supply chain attack on the AI platform Mastra AI to North Korean threat actors.

Kimsuky is a threat group that, according to recent reporting, is targeting organizations with PebbleDash-based tools. A large-scale campaign using ScreenConnect disguised as freeware has also been observed. No details on targeted sectors, regions, or countries are evident from the headlines.

Russian intelligence services target messenger backup keys to gain access to communications. They use fake support texts to steal messaging credentials. The FBI and Ukrainian authorities warn about these attacks.

Russian intelligence services are targeting Signal backup recovery keys to intercept encrypted communications, according to FBI reports. This technique is likely deployed against high-value targets such as government officials, journalists, and activists. The warning highlights the persistent cyber espionage threat posed by Russian state actors.

Russian-speaking threat actors are targeting Fortinet FortiGate devices. The campaign, dubbed 'FortiBleed', has compromised over 86,000 devices and is harvesting credentials. CISA is warning affected customers about these attacks.

DragonForce is a ransomware group that abuses Microsoft Teams relay servers to disguise command-and-control traffic for a backdoor called Backdoor.Turn. This technique allows the group to conduct ransomware attacks while evading detection.

TA4922 is a China-linked threat actor conducting phishing attacks. According to recent reports, TA4922 has expanded its phishing campaigns to the United Kingdom, Germany, Italy, and South Africa. This expansion indicates a broadening of their geographic targeting. No further details about their methods or victims are currently available.

Fox Tempest is a threat actor notable for multi-stage Linux intrusions, gaining access via edge appliances like F5 and collaboration software such as Confluence to achieve enterprise-wide compromise.

CL-STA-1132 is a threat actor exploiting zero-day vulnerabilities in Palo Alto Networks PAN-OS. Recent reporting indicates exploitation of a flaw in the Captive Portal and a critical buffer overflow in the User-ID Authentication Portal to achieve unauthenticated remote code execution. The group targets systems running PAN-OS, likely for espionage or network compromise. Activities include exploitation of CVE-2026-0300.

UNC6692 is a threat group that combines social engineering with malware and cloud abuse. They deployed custom malware suites to compromise targets. The group used sophisticated social engineering techniques. Additionally, they abused cloud infrastructure for malicious purposes.

The People's Republic of China or affiliated actors are alleged to have used an AI project to place spies in Taiwan's chip industry. This points to targeted intelligence activities against the semiconductor sector in Taiwan. No specific malware is mentioned in the report. The allegations are related to espionage activities by the CCP.

CopperDragon is a threat actor mentioned in a report titled 'Not All That Glitters Is Gold: Tracking CopperDragon’s Sparrow Framework Around the Globe'. The report tracks the actor's Sparrow Framework globally. Further details on targeted sectors or countries are not contained in the provided headlines.

Russian state-linked hackers compromised government email servers to steal NATO and EU correspondence. The attackers targeted governmental communication infrastructure. The incident indicates a targeted espionage operation against Western alliances. No specific malware was mentioned in the reporting.

France blames Iran for a sabotage attack on refrigeration controllers at about 700 retail sites. The attack is attributed to the threat actor IRGC. The targets were refrigeration systems in the retail sector. The headline does not mention any specific malware.

Iranian state-backed hackers are blamed by France for attacks on supermarkets that sparked fires. The incidents affected supermarkets in France. No further details on malware or other targets are known from the report.

France accuses the Iranian Revolutionary Guard of being behind cyberattacks. The attacks apparently targeted hacked cooling systems. No further technical details or malware were mentioned in the provided headlines.

Storm-2603 is a threat actor mentioned in a report related to a fileless SharePoint breach. The headline suggests a possible intrusion via SharePoint without file-based malware components. No further details on targeted sectors, regions, or countries are included in the available reporting.

FrostyNeighbor is a threat actor associated with Belarus. According to the headline, Belarus is stepping forward as Russia's cyberwar evolves. No specific targets or malware are mentioned in the reporting. Further details are unavailable.

According to a Risky Bulletin headline, Belarusian state hackers have gotten on the data-wiping train. The headline indicates that this threat actor is now involved in data-wiping activities. No further details about targets or malware are provided in the headline.

VAPOR PANDA uses the AI-driven tool ARTEX to scale a global espionage campaign. The headlines do not specify targeted sectors or countries.

The reporting tracks the adoption of AI in North Korean threat actor tradecraft. It mentions the groups Jade Sleet, Onyx Sleet, Coral Sleet, and Emerald Sleet. Specific targets, regions, or malware are not mentioned in the headline.

The threat actor UAT-11473 is linked to historical activity targeting Cisco SD-WAN. The reporting analyzes an operation or activity referred to as KeyDrift. Details on targeted sectors, regions, or countries are not contained in the provided headline.

Black Basta is linked to external Teams chats used as an entry point for delivering malware within 15 minutes. The attacks appear to occur via external communication channels in Microsoft Teams. No further details on targeted sectors or regions are known from the reporting.

Sandworm (also known as UAC-0099) is a Russian-linked threat actor. According to recent reporting, the group used a new mesh network backdoor in a destructive attack against Ukraine. The attack highlights the ongoing threat from state-aligned cyber operations. Further details on targeted sectors are not evident from the headline.

According to reports, China APT uses the AI-based pentest tool Artex in attacks targeting ConnectWise systems. The attacks apparently focus on vulnerabilities or access related to ConnectWise. Further details on targeted sectors, regions, or malware are not available from the provided headlines.

Prince of Persia is an Iranian APT group. According to a headline, the group is hosting command and control servers in the US for the first time since 2016. Further details on targeted sectors, regions or malware are not contained in the headline.

APT41 has revived the BlackLotus bootkit to attack diplomatic organizations in Central Asia. The threat actor deployed this advanced malware to compromise systems. The attacks targeted diplomatic institutions in the Central Asia region. Further details on affected countries are not known from the reporting.

Russian GRU hackers hit a NATO shipbuilder, an aircraft engine maker, and a law enforcement agency in an espionage campaign. The operation appears aimed at gathering sensitive information from the defense, aerospace, and law enforcement sectors. No specific malware was mentioned in the reporting. The attacks are attributed to Russia's GRU military intelligence unit.

Based on the provided headline 'The journey of a paper unicorn: adventures inside a modern warehouse', no concrete details about targeted sectors, regions, countries, or malware can be derived. The headline is metaphorical and contains no explicit information about Mirage Kitten activities. Further reporting would be required to build a detailed profile.

Russian authorities have arrested the DataSuckers hacking group. No further details about targets or methods are known from the headline.

Storm-2990 is mentioned in reporting related to a hidden network of phishing infrastructure powering global cybercrime. The headline suggests involvement in an ecosystem that supports phishing operations. Specific targets, regions, or malware are not named in the provided headline.

The US arrested two individuals in connection with so-called laptop farms for North Korean IT workers. These farms allow North Korean IT personnel to work remotely for Western companies and generate revenue for the regime. The arrests are part of an intensified law enforcement crackdown on this practice. The reporting does not specify any associated malware.

The U.S. government disrupted a Famous Chollima operation with assistance from CrowdStrike. The reporting headline contains no further details on targeted sectors or regions. Famous Chollima is identified as the threat actor in the headline. No specific malware names are mentioned in the headline.

Reynolds is mentioned in a report titled "Bring Your Own Vulnerable Driver: How EDR Killing Became an Industry". The report focuses on the Bring Your Own Vulnerable Driver (BYOVD) technique and its use to disable EDR systems. No further information about Reynolds' activities, targets, or associated malware is provided in the headline.

NeedyMantis is a threat actor. Recent reporting indicates that this actor provides long-term access to compromised networks. The headline suggests persistent access and possible further activities. Details on targeted sectors or regions are not available.

JADEPUFFER is a threat actor linked to attacks on Microsoft Azure. According to reporting, JADEPUFFER-linked attackers used compromised service principals to delete Azure resources. No further details on targeted sectors or regions are available in the provided headlines.

Storm-3168 is a threat actor that, according to reports, conducts agentic-driven attacks on cloud environments using compromised service principals. Further information about targeted sectors, regions, or used malware is not contained in the provided headlines.

The reporting mentions threat actor Storm-2570 in connection with ransomware. It describes consistent tradecraft across multiple deployments. No further details on targeted sectors or regions are provided in the headlines.

Abdelhamid Naceri is a security researcher who, according to a report, released a zero-day proof-of-concept called BigDiskBuster. This exploit blocks Microsoft Defender updates. No further details about targeted sectors or regions can be derived from the headlines.

PAYLOAD is a ransomware actor that hijacks Active Directory Group Policy Objects (GPOs) to weaponize them for ransomware deployment. The reporting indicates the actor leverages GPO hijacking to propagate or execute ransomware in compromised environments. No further details on targeted sectors or regions are provided in the headline.

Jade Sleet has been linked to a breach at an Indian IT provider. The backdoors FLATROOF and ROOFDECK were used in this incident. No further details on motive or affected systems are available from the reporting.

UTA0560 is a China-linked actor. According to reports, it exploits a Chrome-Windows zero-day chain to deploy the GRIMWEDGE malware. No further details on targeted sectors or regions are provided.

The Russia-linked cyber-espionage group was caught by Anthropic using Claude in hacking operations. The group apparently used the AI assistant for its activities. No further details on target sectors or regions are known from the available report.

The Chinese state-sponsored APT actor is attributed with using the Bluemoon exploit kit. The attacks target users of Windows operating systems. Specific target sectors, regions, or countries are not mentioned in the reporting. This activity highlights the ongoing threat from Chinese hacking groups.

This Russian-speaking threat actor has been observed exploiting PaperCut vulnerabilities in AI-powered attacks. The attacks demonstrate a connection to advanced, possibly AI-assisted methods. No further details on targeted sectors or malware are available from the reporting.

Recent reporting on the actors Storm-3032, Storm-3121, and ShinyHunters includes a headline stating that voice callers exploit BYOD to reach Microsoft 365 and corporate data. No specific targeted sectors, regions, or countries are named in the headline. No malware is directly associated with this activity in the provided headline. The actors are mentioned together in the context of this report.

According to a report by Anthropic, AI enables small actors to run state-level hacking campaigns. This lowers the barrier to entry for groups such as Russian-aligned espionage groups, Chinese state-sponsored actors, and ShinyHunters. The threat landscape becomes more diffuse as even smaller groups can now deploy sophisticated capabilities.

The available headline 'We've got one word for it, and it's usually the wrong one' provides no concrete information about targets, regions, or malware related to UAT-10820. Therefore no details on affected sectors, countries, or malware can be given.

Four unnamed espionage groups are mentioned. The reporting refers to the BlueMoon exploit kit, which turns Chrome and Windows flaws into attacks. No further details about the groups are available.

According to the headline, the Russian-speaking APT actor used hundreds of AI agents to compromise over 440 PaperCut instances. The headline does not mention targeted sectors, regions, or malware. Further operational details are unavailable.

Recent reports show that Chinese espionage groups are exploiting a triple-link chain of zero-day vulnerabilities. The groups appear to be acting in a coordinated manner. No further details on targets or malware are available.

APT31 is a threat group mentioned in recent reporting. According to a headline, four spy groups used the same Chrome and Windows exploit kit within a week. No further details on targeted sectors or regions were provided in the headline.

Multiple China-linked APT groups have been observed using an identical Chrome zero-day exploit. The reporting indicates that different Chinese hacking groups are exploiting the same vulnerability. The headline does not provide details on targeted sectors, regions, or malware.

UAT-11988 is associated with the active exploitation of vulnerabilities in Cisco Secure Firewall Management Center. The provided headlines describe ongoing attacks against this management platform. No further details on affected sectors, regions, or malware are included.

Rhysida is a threat actor known for ransomware attacks. A recent comment reports a Rhysida attack in Berlin, Germany. The headline suggests a security gap favored the attack. No further details on sectors or malware are provided.

The threat actor Spring Ring is associated with vishing attacks targeting Microsoft Teams users. According to the provided headline, the group conducts such attacks. No further details on targeted sectors, regions, or used malware are available from the headline.

Armored Likho and Mirage Kitten are mentioned in a report on the threat landscape for industrial automation systems in Q2 2026. The headline indicates activity by these actors in this sector. No specific attack details, regions, or malware are provided in the headline. Further information cannot be derived from the given material.

The APT group HoneyMyte has updated the CoolClient malware. CoolClient is a backdoor. The new version receives a kernel-level Windows rootkit. No further details are known from the headline.

Armored Likho is a threat actor that, according to the headline, expands its cyber-espionage toolkit. No specific targets, sectors, or regions are mentioned in the provided headlines. There are no further details on associated malware.

CAV3RN is a threat actor that, according to recent reporting, uses Google Apps Script as a C2 relay and DNS-based C2 channel selection. The activities continue under the name 'Project CAV3RN'. No details on targeted sectors, regions, or countries are evident from the provided headline.

UAC-0099 is a threat actor observed in recent attacks. A fake Notepad++ plugin was used to distribute MATCHBOIL.V2. The method relies on social engineering. This is a targeted threat.

LAUNDRY BEAR is a Russian state-sponsored threat actor. A recent zero-click phishing campaign targeting Western organisations was exposed. The campaign was uncovered by the UK and partners.

The Chaos ransomware gang is a threat actor recently linked to the msaRAT malware. This malware uses Chrome and Edge browsers to route C2 traffic. msaRAT enables attackers to gain remote access and steal data. Further details on targets are currently unknown.

Handala is an Iranian hacktivist group that, according to a US warning, targets industrial control systems (ICS) from Siemens, Schneider Electric, and Rockwell Automation. The group may be linked to Iranian state actors and focuses on critical infrastructure. The goal could be sabotage or espionage.

North Korea uses an IT worker scheme to fund Russia's war effort. Under the guise of remote IT jobs, funds are generated that allegedly support the Russian military. This activity demonstrates cooperation between North Korea and Russia in evading sanctions and raising funds.

APT34, an Iranian threat group, is linked to a new module called Project CAV3RN. This module abuses Outlook calendar events for command and control and DNS AAAA records for configuration recovery.

UTA0533 is a threat actor for which no specific details are available in the recent headlines. The provided weekly recap only mentions the actor without elaborating on targets or malware. Further information cannot be inferred from this source.

Russian intelligence service hacks IP cameras to spy on military logistics across NATO states and Ukraine. This threatens the security of military operations. The attacks aim to monitor supply chains and movements. Multiple NATO countries and Ukraine are affected.

UAT-11795 is a threat actor group recently observed in a financially motivated campaign. They deployed the novel Starland RAT and the bespoke WLDR C2 implant. The campaign aims for financial gain, but specific targeted sectors or regions remain unknown. The group appears to leverage custom malware to achieve its objectives.

The Russian intelligence agency is conducting hacking attacks that, according to an advisory, focus on NATO logistics and Ukrainian troops. They hack cameras to obtain confidential information. These activities demonstrate a continued interest in military movements and operations.

UNK_CustomCloak uses OAuth Client ID spoofing to validate stolen Microsoft Entra credentials. This technique enables attackers to take over compromised accounts. No further details are known about this actor.

Russian APT groups are conducting cyberattacks on critical infrastructure routers, according to warnings from the US and allies. These attacks aim to compromise networks and steal sensitive information. Affected entities are primarily in the US and allied nations. Security agencies urge increased vigilance and protective measures.

Russian state intelligence services pose a persistent threat to critical infrastructure. Recent reports indicate that the UK and its allies are calling for enhanced defensive measures. The actors employ advanced cyber operations for espionage purposes.

The EU imposed sanctions on Russian GRU military hackers over cyberattacks. These attacks likely targeted EU member states. The GRU is a known threat actor responsible for offensive cyber operations.

O-UNC-066 is a threat actor group recently observed in a campaign using fake Microsoft Entra passkey enrollment. Users are tricked into registering for a fraudulent passkey, granting unauthorized access to Microsoft 365 accounts. This technique allows attackers to bypass multi-factor authentication. No specific targeted sectors or regions have been disclosed.

The new Helix vishing group has emerged in attacks targeting data theft from SharePoint. Through voice phishing, victims are tricked into revealing credentials. The group does not use known malware but relies on social engineering. Details on target industries and regions are currently unknown.

Hyadina is a threat group linked to the GodDamn Ransomware. This ransomware uses a PoisonX driver to bypass endpoint defenses. Nothing is currently known about further targets or activities of the group.

LapDogs is a China-linked APT group. According to recent reports, it has expanded its arsenal with new 'Leash' backdoors. This backdoor expansion indicates ongoing capability development. Further details on targeted sectors or regions are not known from the reporting.

The given headline does not provide information about Russian state-sponsored threat actors. It reports on critical security patches for Ubiquiti UniFi products.

EvilTokens is a threat actor linked to a new wave of ghost phishing attacks that bypass traditional email security measures. These attacks likely aim to compromise credentials or tokens. The recent campaign highlights the evolving tactics used to infiltrate email systems.

Storm-2372 is a threat group notable for using the DEBULL tooling. This tooling abuses the Microsoft device-code flow to obtain authentication tokens. Targets are Microsoft 365 accounts, suggesting widespread phishing campaigns. The group may be state-sponsored or financially motivated.

A modular command-and-control framework named Cavern Manticore has been linked to an Iran-linked APT group. No further details on targeted sectors or regions are available.

PolinRider is a threat actor with limited available information. The provided reporting only includes a generic headline without details on targets or methods. No specific sectors, regions, or malware are known.

Kimsuky and OceanLotus are known threat actors associated with persistent threats and frequently missed incidents. The report 'Missed incidents, persistent threats, and response gaps' highlights gaps in responding to compromise assessments. These actors often use advanced tactics to remain undetected.

The Lynx ransomware group is a criminal organization that conducts ransomware attacks. It has been linked to the FortiBleed campaign, which focuses on credential theft. No further details about its target sectors or regions are known from the available reporting.

Iranian, Russian, and Chinese state actors, including CyberAv3ngers and IRGC-linked groups, are targeting water systems for sabotage. These attacks threaten critical infrastructure and could endanger public safety.

UNC5792 and UNC4221 are believed to be Russian state-sponsored hacking groups. They have been linked to attacks targeting messaging apps. The US has offered a $10 million bounty for information on these hackers. The attacks continue to evolve.

Woodgnat is a threat actor recently linked to the new 'Mistic' Remote Access Trojan (RAT). This RAT opens the door to several ransomware families, indicating potential use as a first-stage malware. Further details on targeted sectors or regions are not available.

StrikeShark is a threat actor recently observed in a campaign delivering Cobalt Strike through SharkLoader. No further details about targeted sectors or regions are available from the reporting.

A Russian Initial Access Broker is behind the FortiBleed campaign. The actor exploits vulnerabilities in Fortinet devices to gain initial network access. This access is then sold to other cybercriminals. Little is known about the broker's identity.

A Russian ransomware group is exploiting the FortiBleed vulnerability. The attacks target various organizations. An update shows recent developments among the affected victims.

Gentlemen is a ransomware group that uses multiple EDR killers to disable security solutions. This allows them to spread their ransomware more effectively and encrypt systems. Little is known about their specific targets, but the group employs advanced techniques to bypass defenses.

Sapphire Sleet is a threat actor group recently involved in a supply chain attack on the npm package 'Mastra'. The attackers compromised the package and inserted a malicious postinstall payload that executes upon installation. The exact targets and malware details remain unclear. The incident highlights the risks of supply chain attacks in the software development lifecycle.

Dropping Elephant is a threat actor whose tradecraft is tracked through a China-themed loader chain. The headline suggests an analysis of their tactics. No further details on targeted sectors or regions are available from the report.

A Russian-speaking threat actor group conducted a sweeping credential-harvesting campaign, compromising over 30,000 Fortinet devices. The goal was to steal login credentials. Further details on targeted sectors or regions are currently unknown.

Shai-Hulud is a threat actor linked to a supply-chain worm. This worm exploits vulnerabilities in GitHub that were previously dismissed by GitHub as non-security issues. Researchers report that the worm infiltrates the supply chain and spreads through these flaws.

A China-linked threat actor is using the SprySOCKS backdoor, which has expanded to Windows systems with driver-based stealth. Recent reporting indicates an expansion of capabilities. No information on targets or affected regions is available yet.

APT37 is a North Korean cyber espionage group. Recent reporting describes how the group uses fake Microsoft alerts to deploy NarwhalRAT malware. Further details on targeted sectors and countries are not provided in this headline.

This China-linked APT group abused Google Workspace rules to steal emails from research and defense organizations. The attackers leveraged legitimate cloud platform features to stay undetected. The incident highlights the growing threat of cloud-based espionage.

The North Korean threat actor 'Contagious Interview' is known for turning developer tools into malware delivery channels. They likely use trojanized development packages or fake interview processes to compromise developers. Their activities target the global developer community. Recent reports indicate that North Korean hackers are increasingly infiltrating popular developer tools.

UNC6508 is a China-nexus threat actor targeting the public and private medical community. The actor pursues research in artificial intelligence, cybersecurity, medical, and national defense fields. UNC6508 is known to steal sensitive information from these sectors. No further technical details or associated malware were mentioned in the provided reports.

Velvet Ant is a China-linked threat actor known for backdooring a Linux login software. This backdoor allowed the group to hide in compromised systems for nearly a decade. The attack represents a supply chain compromise that granted persistent access.

Chaotic Eclipse is a threat group that continues to actively use Windows exploits, including a new BitLocker bypass. The group shows sustained activity focusing on exploiting vulnerabilities in Windows systems.

China-nexus state-sponsored actors operate the JDY botnet, which has expanded to over 1,500 devices. It is used for cyber reconnaissance purposes. The threat demonstrates the expansion and capabilities of Chinese actors in cyberspace.

The CrowdStrike 2026 Technology Threat Landscape Report indicates that China's ambitions are fueling cyber attacks. China-nexus APT groups such as Glassworm and the Crimson Collective are key actors. These groups target the technology sector to gain strategic advantages.

Earth Dahu (SHADOW-EARTH-066) is a Russia-aligned group exploiting a WinRAR vulnerability to deploy stealer malware in Ukraine. The attacks aim to steal sensitive information from compromised systems. The group operates in Russia's interest and focuses on Ukrainian targets.

The threat actor APT29, also known as UNC6692, has been linked to a social engineering campaign via Microsoft Teams. In this campaign, attackers impersonate IT support. The campaign was reported under the headline 'When “Hi, This Is IT” Comes Through Microsoft Teams'. This underscores the use of legitimate communication platforms for deception.

NSO Group is an Israeli company known for developing spyware such as Pegasus. According to recent reporting, WhatsApp disrupted new phishing attacks using NSO spyware. The attacks were carried out via phishing messages on WhatsApp. NSO Group faces international criticism for using surveillance software against civil society and governments.

VerdantBamboo is a threat actor deploying a BSD variant of the BRICKSTORM malware on Linux appliances. The campaign targets Linux-based devices. No further information on targeted sectors or regions is available.

According to a warning from Google, the group UNC3753 impersonates IT technicians to gain physical access to office spaces. This tactic indicates targeted intrusion attempts where attackers operate on-site. Further details about target sectors or malware used are currently unknown.

OP-512 is a new threat cluster targeting Microsoft IIS servers. The actor uses a custom web shell framework to compromise the servers. The goal is likely to establish persistent access and execute commands. Further details are not available from the provided headlines.

Iranian state-backed ransomware actors use the Nobitex crypto exchange for their operations. The U.S. has imposed sanctions on Nobitex to disrupt these activities.

China-aligned APT groups are ramping up attacks, as indicated by a recent report. The Dragon Weave group has targeted entities in the Czech Republic and Taiwan. No further details on targeted sectors or malware used were disclosed.

The Akira ransomware group's kill chain has been reconstructed from perimeter and endpoint logs. The analysis describes the group's attack sequence. The provided headline does not specify targeted sectors or regions.

The Russian domestic intelligence service FSB and military intelligence service GRU are responsible for numerous cyber espionage and sabotage operations. They often target government agencies, critical infrastructure, and political institutions to collect intelligence and exert influence. According to reports, a server network allegedly used to support cyberattacks has been dismantled.

Nimbus Manticore is a threat actor operating during the Iranian conflict. Its operations are described as 'Fast and Furious', indicating swift and intensive attacks. No further details on targeted sectors or malware are available from the provided reporting.

Screening Serpens is an Iranian Advanced Persistent Threat (APT) group tracked in espionage campaigns in 2026.

Cloud Atlas is a threat actor that was active in the second half of 2025 and early 2026. During this period, it deployed new tools and a new payload. No detailed information about targeted sectors or affected regions is available.

Webworm is a Chinese threat actor. It has been observed using Discord and Microsoft Graph APIs to target European Union governments. The attacks involve exploiting these services to gain access to government systems.

lwxat is a Chinese-speaking threat actor associated with a commodity BadIIS ecosystem. This Malware-as-a-Service infrastructure targets IIS web servers. The actor is mentioned in a report tracking this ecosystem.

Storm-2949 is a threat group that caused a cloud-wide security incident through the compromise of an identity. The actors use stolen credentials to move laterally within cloud infrastructures. Little is known about the specific targets and malware used. The incident highlights the importance of identity protection in cloud environments.

UNC6671 is a threat actor associated with the vishing-based extortion operation BlackFile. It uses voice phishing to extort victims. No further details on targeted sectors, regions, or malware are currently available.

BufferZoneCorp is a threat actor that poisons Ruby Gems and Go modules to exploit CI pipelines for credential theft. By injecting malicious code into package dependencies, the attacker compromises development environments. The goal is to steal credentials to gain access to additional systems. These attacks endanger the integrity of software supply chains.

UAT-4356 is a threat actor recently observed targeting Cisco Firepower devices. Limited information is currently available about the actor's exact methods and objectives. Further research is needed to complete the profile.

The actor is a Chinese state-sponsored APT group conducting supply chain attacks in the hypersonic technology sector. The group targets organizations involved in the development of hypersonic weapons or vehicles. A recent report discusses a solution for detecting such attacks without needing to know the payload. Specific targets and malware used are not known from the available information.

BRICKSTORM is a threat actor group associated with a malware of the same name. The recent report 'vSphere and BRICKSTORM Malware: A Defender's Guide' focuses on their activities targeting VMware vSphere environments. No further specific information about targeted sectors or regions is available. The malware appears to aim at virtualized infrastructures.

UNC1069 is a North Korea-linked threat actor that recently executed a supply chain attack by compromising the widely used Axios NPM package. This incident highlights their focus on software supply chain attacks to target a broad range of victims.

No specific information about UNC6201 and UNC5807 is available from the provided headline. The M-Trends 2026 report provides general insights and strategies from Mandiant. Therefore, no further details can be inferred.