Tag: targeted attack

4 Attack Reports | 0 Vulnerabilities

Attack reports

The Latest PlugX Variant Executed by STATICPLUGIN

In January 2026, a new variant of the PlugX malware was observed being used in targeted attacks. Analysis suggests involvement of the UNC6384 APT group, linked to Mustang Panda, targeting government agencies in Southeast Asia. The malware uses a browser updater disguise to download and execute a ma…

dll-sideloading

targeted-attack

Published: February 25, 2026

Downloadable IOCs: 11

Android backdoor spies on Russian business employees

A sophisticated Android backdoor named Android.Backdoor.916.origin is targeting Russian business representatives. The malware, disguised as an antivirus app called 'GuardCB', has extensive surveillance capabilities including intercepting calls, streaming camera footage, stealing data from messaging…

android.backdoor.916.origin

targeted-attack

Published: August 25, 2025

Downloadable IOCs: 0

SOC files: an APT41 attack on government IT services in Africa

Kaspersky's MDR team detected a targeted attack by APT41 against government IT services in Africa. The attackers used Impacket tools, Cobalt Strike, and custom agents for lateral movement and data collection. They leveraged DLL sideloading techniques and publicly available tools like Mimikatz and R…

dll sideloading

credential harvesting

lateral movement

data exfiltration

targeted attack

Published: August 20, 2025

Downloadable IOCs: 0

Sophisticated backdoor mimicking secure networking software updates

A sophisticated backdoor targeting Russian organizations in government, finance, and industry sectors was discovered masquerading as updates for ViPNet secure networking software. The malware, distributed in LZH archives, exploits a path substitution technique to execute a malicious loader that dep…

software updates

targeted attack

secure networking

heur:trojan.win32.loader.gen

path substitution

Published: April 22, 2025

Downloadable IOCs: 0

Click here to see more Attack Reports