SecuriTricks - cyberespionage

MuddyWater: Snakes by the riverbank

MuddyWater, an Iran-aligned cyberespionage group, has been targeting critical infrastructure in Israel and Egypt with custom malware and improved tactics. The campaign uses previously undocumented tools like the Fooder loader and MuddyViper backdoor to enhance defense evasion and persistence. Foode…

iran

credential theft

cyberespionage

defense evasion

critical infrastructure

Published: January 3, 2026

Downloadable IOCs: 9

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

ESET researchers have uncovered a new China-aligned APT group named LongNosedGoblin targeting governmental entities in Southeast Asia and Japan for cyberespionage. The group employs a varied custom toolset of C#/.NET applications and abuses Group Policy for lateral movement. Key tools include NosyH…

Published: January 3, 2026

Downloadable IOCs: 10

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

An internal leak from APT35 (Charming Kitten) reveals a sophisticated, state-directed cyber-intelligence operation targeting diplomatic, government, and corporate networks in the Middle East and Asia. The documents expose a bureaucratic structure with defined workflows, performance metrics, and spe…

intelligence collection

Published: November 22, 2025

Downloadable IOCs: 1

Gotta fly: Targeting the UAV sector

ESET researchers have uncovered a new instance of Operation DreamJob, a cyberespionage campaign attributed to the North Korea-aligned Lazarus group. The attackers targeted European companies in the defense industry, particularly those involved in unmanned aerial vehicle (UAV) technology. The campai…

Published: November 9, 2025

Downloadable IOCs: 0

Gamaredon X Turla collaboration

ESET Research has uncovered collaboration between notorious APT groups Gamaredon and Turla, both associated with Russia's FSB, targeting high-profile victims in Ukraine. The research reveals Gamaredon tools being used to restart and deploy Turla's Kazuar backdoor on compromised machines. This marks…

Published: September 27, 2025

Downloadable IOCs: 0

Significant Risk and Proactive Defense

A comprehensive analysis reveals a substantial threat posed by domains linked to Salt Typhoon and UNC4841, likely China-associated cyberespionage actors. The investigation uncovered a larger network of domain names beyond those publicly known, indicating a pattern of long-term access and sophistica…

cyberespionage

telecommunications

persistent threat

domain infrastructure

2025-09-08

long-term access

Published: September 8, 2025

Downloadable IOCs: 47

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

APT-C-53, also known as Gamaredon, is a Russian state-sponsored threat group active since 2013, targeting Ukrainian government and military entities. The group has upgraded its attack techniques, focusing on dynamic cloud-based C2 infrastructure and targeted delivery of cloud storage tools. In 2025…

Published: September 1, 2025

Downloadable IOCs: 11

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Secret Blizzard, a Russian state actor, has been conducting a cyberespionage campaign targeting embassies in Moscow using an adversary-in-the-middle (AiTM) position to deploy ApolloShadow malware. This campaign, ongoing since 2024, poses a high risk to diplomatic entities relying on local internet …

Published: August 8, 2025

Downloadable IOCs: 2

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage

Check Point Research (CPR) uncovered an active-weaponized Microsoft WebDAV zero‑day (CVE‑2025‑33053) exploited by the Stealth Falcon APT in a targeted campaign against defense and government organizations across the Middle East and Africa. The attack began with a spear-phishing-disguised .url file …

Published: June 11, 2025

Downloadable IOCs: 40

Whispering in the dark

ESET researchers uncovered a cyberespionage campaign by BladedFeline, an Iran-aligned APT group likely tied to OilRig. The group has targeted Kurdish and Iraqi government officials since at least 2017, using various malicious tools including the Whisper backdoor, PrimeCache IIS module, and reverse …

Published: June 10, 2025

Downloadable IOCs: 12

APT 41: Threat Intelligence Report and Malware Analysis

APT41, a sophisticated Chinese state-sponsored threat actor, blends cyber espionage with cybercrime tactics. They target various sectors globally, including healthcare, telecom, and government entities. Recently, APT41 was observed using Google Calendar for malware command-and-control on a Taiwanes…

Published: June 10, 2025

Downloadable IOCs: 10

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

The research outlines China-nexus threat actors targeting SentinelOne and other organizations between 2024 and 2025. It details intrusions into an IT services company managing SentinelOne's hardware logistics and reconnaissance of SentinelOne's servers. The attacks involved ShadowPad malware and a …

Published: June 10, 2025

Linked vulnerabilities : CVE-2024-8190 (CVSS 7.2), CVE-2024-8963 (CVSS 9.1), CVE-2024-1709, CVE-2023-46747

Downloadable IOCs: 24

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

Void Blizzard, a newly identified Russia-affiliated threat actor, has been conducting global cyberespionage operations since April 2024. Their primary targets are organizations in critical sectors, particularly in NATO member states and Ukraine, including government, defense, transportation, media,…

Published: May 27, 2025

Downloadable IOCs: 3

The Espionage Toolkit: A Closer Look at its Advanced Techniques

Earth Alux, a China-linked APT group, is actively conducting cyberespionage attacks against key sectors in the APAC and Latin American regions. The group exploits vulnerable services in exposed servers to gain initial access and deploys web shells like GODZILLA. Their primary backdoor, VARGEIT, is …

Published: March 31, 2025

Downloadable IOCs: 0

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

A zero-day vulnerability in 7-Zip (CVE-2025-0411) was exploited by Russian cybercrime groups to target Ukrainian organizations. The vulnerability allows bypassing Windows Mark-of-the-Web protections through double archiving, enabling execution of malicious content. The campaign involved spear-phish…

mark-of-the-web bypass

Published: February 4, 2025

Downloadable IOCs: 0

Hunt for RedCurl

Huntress uncovered RedCurl activity across several Canadian organizations in late 2024, tracing back to November 2023. RedCurl, known for cyberespionage, targets various industries to access confidential data without encrypting systems or demanding ransom. The group employs unique tactics, includin…

Published: January 10, 2025

Downloadable IOCs: 14

Unveiling WolfsBane: Linux counterpart to Gelsevirine

ESET researchers have discovered previously unknown Linux backdoors attributed to the China-aligned Gelsemium APT group. The main backdoor, named WolfsBane, is the Linux equivalent of Gelsemium's Gelsevirine backdoor for Windows. Another backdoor, FireWood, is connected to the group's Project Wood …

Published: November 22, 2024

Downloadable IOCs: 41

Mind the (air) gap: GoldenJackal gooses government guardrails

ESET researchers uncovered two distinct toolsets used by the GoldenJackal APT group to breach air-gapped systems in government organizations. The first toolset, observed in 2019, included GoldenDealer for delivering executables via USB drives, GoldenHowl as a modular backdoor, and GoldenRobo for fi…

Published: November 17, 2024

Downloadable IOCs: 0

Evasive Panda scouting cloud services

CloudScout is a post-compromise toolset used by Evasive Panda to target a Taiwanese government entity and religious organization between 2022 and 2023. The toolset can retrieve data from various cloud services using stolen web session cookies. It works with MgBot, Evasive Panda's malware framework,…

Published: October 28, 2024

Downloadable IOCs: 17

Unauthorized RDP Connections For Cyberespionage Operations

Cyble Research and Intelligence Labs uncovered an ongoing cyberattack campaign utilizing malicious LNK files to gain unauthorized Remote Desktop access on compromised systems. The sophisticated multi-stage attack chain employs PowerShell and BAT scripts to evade detection, create administrative acc…

Published: October 26, 2024

Downloadable IOCs: 0

Chinese APT Abuses VSCode to Target Government in Asia

The report details a campaign by the Chinese advanced persistent threat (APT) group Stately Taurus, which carried out cyberespionage operations against government entities in Southeast Asia. The group employed a novel technique that leveraged the reverse shell feature of Visual Studio Code to gain …

Published: September 9, 2024

Downloadable IOCs: 17

Suspected Cyber Espionage Campaign Targeting Global Organizations

An analysis identified a suspected cyber espionage campaign by TAG-100, a threat group exploiting internet-facing devices and utilizing open-source tools like the Go backdoor Pantegana. The campaign compromised two Asia-Pacific intergovernmental organizations and targeted multiple diplomatic, trade…

Published: July 17, 2024

Linked vulnerabilities : CVE-2024-3400

Downloadable IOCs: 25

Operation Crimson Palace: A Technical Deep Dive

Sophos Managed Detection and Response initiated a threat hunt across customers after detecting abuse of a vulnerable VMware executable. The hunt uncovered a complex, persistent cyberespionage campaign by Chinese state-sponsored actors targeting a high-profile government organization in Southeast As…

Published: June 6, 2024

Downloadable IOCs: 138

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

An analysis reveals long-term espionage operations by a Chinese advanced persistent threat (APT) group against at least seven governmental entities across the Middle East, Africa and Asia since late 2022. The threat actor attempts to obtain sensitive and classified information about diplomatic and …

Published: May 23, 2024

Linked vulnerabilities : CVE-2021-34473, CVE-2021-26855

Downloadable IOCs: 28

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

This comprehensive analysis delves into the continuous evolution and refinement of sophisticated malware entities employed by a persistent cyberespionage group targeting organizations in the Asia-Pacific region. The malware, known as Waterbear and its latest iteration, Deuterbear, have undergone si…

Published: May 21, 2024

Downloadable IOCs: 29

Tag: cyberespionage

Attack reports

MuddyWater: Snakes by the riverbank

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

Attempts to sniff out governmental affairs in Southeast Asia and Japan

Sharpening the knife: strategic evolution of GOLD BLADE

Snakes by the riverbank

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

Gotta fly: Targeting the UAV sector

Gamaredon X Turla collaboration

Significant Risk and Proactive Defense

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage

Whispering in the dark

APT 41: Threat Intelligence Report and Malware Analysis

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

The Espionage Toolkit: A Closer Look at its Advanced Techniques

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

Hunt for RedCurl

Unveiling WolfsBane: Linux counterpart to Gelsevirine

Mind the (air) gap: GoldenJackal gooses government guardrails

Evasive Panda scouting cloud services

Unauthorized RDP Connections For Cyberespionage Operations

Chinese APT Abuses VSCode to Target Government in Asia

Suspected Cyber Espionage Campaign Targeting Global Organizations

Operation Crimson Palace: A Technical Deep Dive

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

Tag: cyberespionage

Attack reports

MuddyWater: Snakes by the riverbank

LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan

Attempts to sniff out governmental affairs in Southeast Asia and Japan

Sharpening the knife: strategic evolution of GOLD BLADE

Snakes by the riverbank

APT35 Internal Leak of Hacking Campaigns Against Lebanon, Kuwait, Turkey, Saudi Arabia, Korea, and Domestic Iranian Targets

Gotta fly: Targeting the UAV sector

Gamaredon X Turla collaboration

Significant Risk and Proactive Defense

Analysis of APT-C-53 (Gamaredon) Attack on Ukrainian Government Agencies

Frozen in transit: Secret Blizzard's AiTM campaign against diplomats

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage

Whispering in the dark

APT 41: Threat Intelligence Report and Malware Analysis

Follow the Smoke | China-nexus Threat Actors Hammer At the Doors of Top Tier Targets

New Russia-affiliated actor Void Blizzard targets critical sectors for espionage

The Espionage Toolkit: A Closer Look at its Advanced Techniques

CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks

Hunt for RedCurl

Unveiling WolfsBane: Linux counterpart to Gelsevirine

Mind the (air) gap: GoldenJackal gooses government guardrails

Evasive Panda scouting cloud services

Unauthorized RDP Connections For Cyberespionage Operations

Chinese APT Abuses VSCode to Target Government in Asia

Suspected Cyber Espionage Campaign Targeting Global Organizations

Operation Crimson Palace: A Technical Deep Dive

Operation Specter: An Active Cyberespionage Campaign Leverages Rare Tool Set to Target Governmental Entities in the Middle East, Africa and Asia

Cyberespionage Group Earth Hundun's Continuous Refinement of Waterbear and Deuterbear

Stealth Falcon and Horus: A Saga of Middle Eastern Cyber Espionage