The Invisible Intrusion A completely mundane email, utterly devoid of malicious links or suspicious attachments, proved sufficient for the formidable TA488 hacker collective to secure persistent access to a victim’s inbox. Consequently, the perpetrators...
An ordinary email attachment can serve as the perilous gateway to a sophisticated attack chain when a meticulously crafted toolkit lurks behind a seemingly benign document. Recently, analysts at 360 Advanced Threat Research uncovered...
Google is introducing a unified naming system for the hacker groups its specialists track. Instead of labels like APT1 and a jumble of unrelated identifiers, attackers will now receive memorable two-word aliases. The transition...
Bypassing the Code: A Compromise of Trust An unidentified threat actor effectively liquidated the entirety of the cryptocurrency protocol AFX Trade without exploiting a single vulnerability within its underlying smart contract code. Instead, the...
The Inversion of State-Sponsored Cyber Heists For years, state-sponsored North Korean cyber operatives conducted audacious digital heists across international borders to siphon foreign currency and sustain the regime’s nuclear weapons program. However, this established...
The Strategic Value of Silent Persistence Iranian threat actors operate with significantly greater stealth than conventionally perceived. Rather than executing immediate, high-profile disruptive attacks, these adversaries meticulously maintain long-term, covert access within compromised networks....
Evolution of the Golden Chickens Ecosystem Cybercriminals operating within the TAG-195 ecosystem have fundamentally restructured their malware architecture, adopting a highly modular approach. Consequently, compromised systems now only receive the specific functionalities required for...
An Unprotected Directory Exposes Espionage Operations A single overlooked server misconfiguration inadvertently exposed the inner workings of an entire China-nexus cyber espionage infrastructure. Cybersecurity specialists at Group-IB gained access to an exposed directory, uncovering...
Unveiling Operation STANDOFF A singular malicious installer served as the entry point into a vast criminal ecosystem that concurrently compromised endpoints, exfiltrated sensitive data, hijacked victim bandwidth as proxy relays, and orchestrated vast networks...
Cybercriminals have found a way to weaponise Windows’ faith in digital signatures. They compromised the workstation of a DigiCert employee and intercepted certificates bound for the company’s customers. A Chinese cybercrime group stood behind...
US authorities have seized more than a thousand domains that illegally broadcast matches from the 2026 FIFA World Cup. Many such sites did more than infringe copyright. They could also seed visitors’ devices with...
Exploiting Internal Infrastructure A fabricated price arrived with a futuristic timestamp. This allowed a malicious actor to turn ordinary transactions into incredibly profitable trades. Consequently, the attacker siphoned roughly $18 million from the decentralized...
