SecuriTricks - military

Operation SkyCloak: Tor Campaign targets Military of Russia & Belarus

A sophisticated campaign targeting Russian and Belarusian military personnel has been identified, using multi-stage infection chains and decoy documents. The attackers deploy OpenSSH and Tor bridges to establish covert remote access and lateral movement capabilities. The infection process involves …

obfuscation

espionage

Published: October 31, 2025

Downloadable IOCs: 12

Operation SouthNet: SideWinder Expands Phishing and Malware Operations in South Asia

APT SideWinder has launched a new targeted operation dubbed Operation SouthNet, focusing on the maritime sector in South Asia, particularly Pakistan and Sri Lanka. The group leverages free hosting platforms to deploy credential-harvesting portals and weaponized lure documents, while staging malware…

apt

phishing

government

credential harvesting

south asia

military

2025-10-06

Published: October 6, 2025

Downloadable IOCs: 0

AI-Driven Deepfake Military ID Fraud Campaign

The Kimsuky APT group has launched a sophisticated spear-phishing campaign using AI-generated deepfake military ID cards to target South Korean defense institutions. The attack impersonates military employee ID issuance processes and exploits ChatGPT to create convincing fake ID images. The malware…

Published: September 15, 2025

Downloadable IOCs: 21

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

A Chinese APT group compromised a Philippine military company using a new, fileless malware framework called EggStreme. This sophisticated multi-stage toolset achieves persistent, low-profile espionage by injecting malicious code directly into memory and leveraging DLL sideloading. The core compone…

eggstremereflectiveloader

Published: September 10, 2025

Downloadable IOCs: 12

Hybrid Russian Espionage and Influence Campaign Aims to Compromise Ukrainian Military Recruits and Deliver Anti-Mobilization Narratives

A Russian hybrid espionage and influence operation, dubbed UNC5812, targets potential Ukrainian military recruits through a Telegram persona called 'Civil Defense'. The campaign delivers Windows and Android malware, including SUNSPINNER, PURESTEALER, and CRAXSRAT, while simultaneously spreading ant…

Published: October 28, 2024

Linked vulnerabilities : CVE-2024-47575 (CVSS 9.8)

Downloadable IOCs: 3

Tag: military

Attack reports

Operation SkyCloak: Tor Campaign targets Military of Russia & Belarus

Operation SouthNet: SideWinder Expands Phishing and Malware Operations in South Asia

AI-Driven Deepfake Military ID Fraud Campaign

EggStreme Malware: Unpacking a New APT Framework Targeting a Philippine Military Company

Hybrid Russian Espionage and Influence Campaign Aims to Compromise Ukrainian Military Recruits and Deliver Anti-Mobilization Narratives