SecuriTricks - cyberespionage

Snakes by the riverbank

ESET researchers have identified new MuddyWater activity targeting organizations in Israel and Egypt. The Iran-aligned cyberespionage group deployed custom tools to improve defense evasion and persistence, including a Fooder loader to execute the MuddyViper backdoor. The campaign demonstrates a mor…

backdoor

spearphishing

critical infrastructure

Published: December 2, 2025

Downloadable IOCs: 0

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

An internal leak from APT35 (Charming Kitten) reveals a sophisticated, state-directed cyber-intelligence operation targeting diplomatic, government, and corporate networks in the Middle East and Asia. The documents expose a bureaucratic structure with defined workflows, performance metrics, and spe…

intelligence collection

Published: November 22, 2025

Downloadable IOCs: 1

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

The research outlines China-nexus threat actors targeting SentinelOne and other organizations between 2024 and 2025. It details intrusions into an IT services company managing SentinelOne's hardware logistics and reconnaissance of SentinelOne's servers. The attacks involved ShadowPad malware and a …

Published: June 10, 2025

Linked vulnerabilities : CVE-2024-8190 (CVSS 7.2), CVE-2024-8963 (CVSS 9.1), CVE-2024-1709, CVE-2023-46747

Downloadable IOCs: 24

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Void Blizzard, a newly identified Russia-affiliated threat actor, has been conducting global cyberespionage operations since April 2024. Their primary targets are organizations in critical sectors, particularly in NATO member states and Ukraine, including government, defense, transportation, media,…

Published: May 27, 2025

Downloadable IOCs: 3

The Espionage Toolkit: A Closer Look at its Advanced Techniques

Earth Alux, a China-linked APT group, is actively conducting cyberespionage attacks against key sectors in the APAC and Latin American regions. The group exploits vulnerable services in exposed servers to gain initial access and deploys web shells like GODZILLA. Their primary backdoor, VARGEIT, is …

Published: March 31, 2025

Downloadable IOCs: 0

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

A zero-day vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. The vulnerability allows bypassing Windows Mark-of-the-Web protections through double archiving, enabling execution of malicious content. The campaign involved spear-phish…

mark-of-the-web bypass

Published: February 4, 2025

Downloadable IOCs: 0

Hunt for RedCurl

Huntress uncovered RedCurl activity across several Canadian organizations in late 2024, tracing back to November 2023. RedCurl, known for cyberespionage, targets various industries to access confidential data without encrypting systems or demanding ransom. The group employs unique tactics, includin…

Published: January 10, 2025

Downloadable IOCs: 14

Unveiling WolfsBane: Linux counterpart to Gelsevirine

ESET researchers have discovered previously unknown Linux backdoors attributed to the China-aligned Gelsemium APT group. The main backdoor, named WolfsBane, is the Linux equivalent of Gelsemium's Gelsevirine backdoor for Windows. Another backdoor, FireWood, is connected to the group's Project Wood …

Published: November 22, 2024

Downloadable IOCs: 41

Mind the (air) gap: GoldenJackal gooses government guardrails

ESET researchers uncovered two distinct toolsets used by the GoldenJackal APT group to breach air-gapped systems in government organizations. The first toolset, observed in 2019, included GoldenDealer for delivering executables via USB drives, GoldenHowl as a modular backdoor, and GoldenRobo for fi…

Published: November 17, 2024

Downloadable IOCs: 0

Evasive Panda scouting cloud services

CloudScout is a post-compromise toolset used by Evasive Panda to target a Taiwanese government entity and religious organization between 2022 and 2023. The toolset can retrieve data from various cloud services using stolen web session cookies. It works with MgBot, Evasive Panda's malware framework,…

Published: October 28, 2024

Downloadable IOCs: 17

Unauthorized RDP Connections For Cyberespionage Operations

Cyble Research and Intelligence Labs uncovered an ongoing cyberattack campaign utilizing malicious LNK files to gain unauthorized Remote Desktop access on compromised systems. The sophisticated multi-stage attack chain employs PowerShell and BAT scripts to evade detection, create administrative acc…

Published: October 26, 2024

Downloadable IOCs: 0

Chinese APT Abuses VSCode to Target Government in Asia

The report details a campaign by the Chinese advanced persistent threat (APT) group Stately Taurus, which carried out cyberespionage operations against government entities in Southeast Asia. The group employed a novel technique that leveraged the reverse shell feature of Visual Studio Code to gain …

Published: September 9, 2024

Downloadable IOCs: 17

Suspected Cyber Espionage Campaign Targeting Global Organizations

An analysis identified a suspected cyber espionage campaign by TAG-100, a threat group exploiting internet-facing devices and utilizing open-source tools like the Go backdoor Pantegana. The campaign compromised two Asia-Pacific intergovernmental organizations and targeted multiple diplomatic, trade…

Published: July 17, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 25

Operation Crimson Palace: A Technical Deep Dive

Sophos Managed Detection and Response initiated a threat hunt across customers after detecting abuse of a vulnerable VMware executable. The hunt uncovered a complex, persistent cyberespionage campaign by Chinese state-sponsored actors targeting a high-profile government organization in Southeast As…

Published: June 6, 2024

Downloadable IOCs: 138

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

An analysis reveals long-term espionage operations by a Chinese advanced persistent threat (APT) group against at least seven governmental entities across the Middle East, Africa and Asia since late 2022. The threat actor attempts to obtain sensitive and classified information about diplomatic and …

Published: May 23, 2024

Linked vulnerabilities : CVE-2021-34473, CVE-2021-26855

Downloadable IOCs: 28

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a persistent cyberespionage group targeting organizations in the Asia-Pacific region. The malware, known as Waterbear and its latest iteration, Deuterbear, have undergone si…

Published: May 21, 2024

Downloadable IOCs: 29

Tag: cyberespionage

Attack reports

Snakes by the riverbank

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

Gotta fly: Targeting the UAV sector

Gamaredon X Turla collaboration

Significant Risk and Proactive Defense

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage

Whispering in the dark

APT 41: Threat Intelligence Report and Malware Analysis

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

The Espionage Toolkit: A Closer Look at its Advanced Techniques

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

Hunt for RedCurl

Unveiling WolfsBane: Linux counterpart to Gelsevirine

Mind the (air) gap: GoldenJackal gooses government guardrails

Evasive Panda scouting cloud services

Unauthorized RDP Connections For Cyberespionage Operations

Chinese APT Abuses VSCode to Target Government in Asia

Suspected Cyber Espionage Campaign Targeting Global Organizations

Operation Crimson Palace: A Technical Deep Dive

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

Tag: cyberespionage

Attack reports

Snakes by the riverbank

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

Gotta fly: Targeting the UAV sector

Gamaredon X Turla collaboration

Significant Risk and Proactive Defense

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage

Whispering in the dark

APT 41: Threat Intelligence Report and Malware Analysis

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

The Espionage Toolkit: A Closer Look at its Advanced Techniques

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

Hunt for RedCurl

Unveiling WolfsBane: Linux counterpart to Gelsevirine

Mind the (air) gap: GoldenJackal gooses government guardrails

Evasive Panda scouting cloud services

Unauthorized RDP Connections For Cyberespionage Operations

Chinese APT Abuses VSCode to Target Government in Asia

Suspected Cyber Espionage Campaign Targeting Global Organizations

Operation Crimson Palace: A Technical Deep Dive

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage