SecuriTricks - government

Russian APT actor phishes the Baltics and the Balkans

A Russian Advanced Persistent Threat (APT) group has been targeting government entities in the Baltic and Balkan regions with sophisticated phishing campaigns. The attackers use email attachments spoofing official documents to lure victims into entering their credentials on fake login pages. The ph…

apt

phishing

Published: December 16, 2025

Downloadable IOCs: 0

TransparentTribe Targets Indian Military with DeskRAT Malware

TransparentTribe, a Pakistani-nexus intrusion set, has launched a new cyber espionage campaign targeting Indian military organizations with DeskRAT malware. The infection chain begins with phishing emails containing links to malicious ZIP archives hosted on staging servers. These archives contain D…

government

2025-10-23

deskrat

Published: October 23, 2025

Downloadable IOCs: 0

Operation SouthNet: SideWinder Expands Phishing and Malware Operations in South Asia

APT SideWinder has launched a new targeted operation dubbed Operation SouthNet, focusing on the maritime sector in South Asia, particularly Pakistan and Sri Lanka. The group leverages free hosting platforms to deploy credential-harvesting portals and weaponized lure documents, while staging malware…

apt

phishing

government

credential harvesting

south asia

military

2025-10-06

Published: October 6, 2025

Downloadable IOCs: 0

Werewolf raids Russia's public sector with trusted relationship attacks

Cavalry Werewolf, a malicious actor group, targeted Russian state agencies and enterprises in the energy, mining, and manufacturing sectors from May to August 2025. The attackers used targeted phishing emails, posing as Kyrgyz government officials, to gain initial access. They employed custom malwa…

Published: October 2, 2025

Downloadable IOCs: 0

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Phantom Taurus, a newly identified Chinese state-sponsored threat actor, has been conducting espionage operations targeting government and telecommunications organizations across Africa, the Middle East, and Asia. The group's primary focus includes ministries of foreign affairs, embassies, and mili…

Published: September 30, 2025

Downloadable IOCs: 4

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

A new threat group dubbed Silent Lynx has been uncovered targeting entities in Kyrgyzstan and neighboring nations. The group, believed to be Kazakhstan-based, employs sophisticated multi-stage attack strategies using ISO files, C++ loaders, PowerShell scripts, and Golang implants. Their campaigns f…

xerox_scan17510875802718752175.exe

kyrgyzstan

resocks

Published: January 21, 2025

Downloadable IOCs: 12

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

Earth Estries, a Chinese APT group, has been aggressively targeting critical sectors globally since 2023. The group employs advanced techniques and multiple backdoors, including GHOSTSPIDER, SNAPPYBEE, and MASOL RAT, to compromise organizations in telecommunications, government, and other industrie…

Published: December 3, 2024

Linked vulnerabilities : CVE-2024-21887, CVE-2023-46805, CVE-2021-26855, CVE-2023-48788, CVE-2022-3236, CVE-2021-26858, CVE-2021-26857, CVE-2021-27065

Downloadable IOCs: 57

Arsenal honed against Russia's government organizations

Core Werewolf, a threat actor targeting Russia's defense industry and critical infrastructure since 2021, has evolved its tactics. The group now employs a new loader written in AutoIt and has expanded its delivery methods to include Telegram alongside email. Their campaign involves RAR archives con…

critical infrastructure

sfx executables

rar archives

Published: October 11, 2024

Downloadable IOCs: 25

Aiming at domestic government and enterprises! Deeply revealed ransomware operator Rast gang

A new ransomware threat, dubbed Rast, has emerged targeting Chinese government and enterprises since December 2023. Written in Rust, Rast has infected over 6,800 terminals, successfully encrypting more than 5,700. The Rast gang, named after the ransomware, operates primarily between 20:00 and 05:00…

Published: September 30, 2024

Downloadable IOCs: 21

Credential Phishing Pages Mimicking Legitimate Webmail Login Portals

Since August 2024, an India-linked threat actor has been targeting entities in China and South Asia using credential phishing pages that mimic legitimate webmail login portals. The campaign primarily focuses on government and defense sectors. The phishing domains share common characteristics, inclu…

Published: September 18, 2024

Downloadable IOCs: 20

Targeted Iranian Attacks Against Iraqi Government Infrastructure

Check Point Research uncovered a new malware campaign targeting Iraqi government entities, employing custom tools named Veaty and Spearal. The attack utilizes various techniques including passive IIS backdoors, DNS tunneling, and C2 communication via compromised email accounts. The malware shows co…

Published: September 12, 2024

Downloadable IOCs: 16

Report on Ukraine government attack campaign

Ukraine's government cybersecurity incident response team, CERT-UA, obtained information about the distribution of emails themed around prisoners of war, containing links to download an archive named 'spysok_kursk.zip'. This archive contained a CHM file with JavaScript code that launched an obfusca…

Published: August 23, 2024

Downloadable IOCs: 33

Quartet of Trouble: XWorm, AsyncRAT, VenomRAT, and...

eSentire's Threat Response Unit (TRU) uncovered a malware campaign affecting a government customer. The infection involved multiple threats - XWorm, VenomRAT, PureLogs Stealer, and AsyncRAT - hosted on a TryCloudflare WebDAV server. The initial vector was a phishing email with a malicious ZIP file.…

Published: August 5, 2024

Downloadable IOCs: 7

espionage group targets government agencies with and more infection techniques

A recently discovered threat actor, dubbed 'SneakyChef,' has been conducting an ongoing espionage campaign targeting government agencies across different regions, primarily utilizing the SugarGh0st malware. The group employs decoy documents impersonating government entities and infects victims thro…

Published: June 24, 2024

Downloadable IOCs: 148

Sharp Dragon Expands Towards Africa and The Caribbean

Check Point Research has observed a significant shift in the activities and lures of Sharp Dragon, a Chinese threat actor, now targeting governmental organizations in Africa and the Caribbean. This expansion aligns with Sharp Dragon's known tactics of compromising email accounts to spread weaponize…

Published: May 23, 2024

Linked vulnerabilities : CVE-2023-0669

Downloadable IOCs: 38

APT28 campaign against Polish government institutions

The CERT Polska team is investigating a large-scale malware campaign carried out by the Russian intelligence group APT28, which has been targeting Polish government institutions in the past year and is believed to be linked to the GRU.

Published: May 8, 2024

Downloadable IOCs: 74

Tag: government

Attack reports

Russian APT actor phishes the Baltics and the Balkans

TransparentTribe Targets Indian Military with DeskRAT Malware

Operation SouthNet: SideWinder Expands Phishing and Malware Operations in South Asia

Werewolf raids Russia's public sector with trusted relationship attacks

Phantom Taurus: A New Chinese Nexus APT and the Discovery of the NET-STAR Malware Suite

Threat Profile: Conti Ransomware Group

APT36: Targets Indian BOSS Linux Systems with Weaponized AutoStart Files

SOC files: an APT41 attack on government IT services in Africa

A Phishing Campaign Targeting Indian Government Entities

Active Exploitation of Microsoft SharePoint Vulnerabilities

SadFuture: Mapping XDSpy latest evolution

Cyber Attacks on Government Agencies: Detect and Investigate

Targets Tajikistan: New Macro Word Documents Phishing Tactics

Blind Eagle: ...And Justice for All

Cyber Espionage using PowerShell stealer WRECKSTEEL

Operation FishMedley targeting governments, NGOs, and think tanks

Auto-Color: An Emerging and Evasive Linux Backdoor

The ticket that doesn't exist: a new threat discovered - FakeTicketer

Unveiling Silent Lynx APT Targeting Entities Across Kyrgyzstan & Neighboring Nations

Game of Emperor: Unveiling Long Term Earth Estries Cyber Intrusions

Arsenal honed against Russia's government organizations

Aiming at domestic government and enterprises! Deeply revealed ransomware operator Rast gang

Credential Phishing Pages Mimicking Legitimate Webmail Login Portals

Targeted Iranian Attacks Against Iraqi Government Infrastructure

Report on Ukraine government attack campaign

Quartet of Trouble: XWorm, AsyncRAT, VenomRAT, and...

espionage group targets government agencies with and more infection techniques

Sharp Dragon Expands Towards Africa and The Caribbean

APT28 campaign against Polish government institutions